Re: [systemd-devel] [PATCH] Drop ConditionCapability=CAP_MKNOD from *udev* units

2013-07-25 Thread Frederic Crozat
Le mercredi 24 juillet 2013 à 18:41 -0300, Gerardo Exequiel Pozzi a écrit : Signed-off-by: Gerardo Exequiel Pozzi vmlinuz...@yahoo.com.ar --- units/systemd-udev-settle.service.in | 1 - units/systemd-udev-trigger.service.in | 1 - units/systemd-udevd-control.socket| 1 -

Re: [systemd-devel] [PATCH] Drop ConditionCapability=CAP_MKNOD from *udev* units

2013-07-25 Thread Thomas Bächler
Am 25.07.2013 10:18, schrieb Frederic Crozat: Le mercredi 24 juillet 2013 à 18:41 -0300, Gerardo Exequiel Pozzi a écrit : Signed-off-by: Gerardo Exequiel Pozzi vmlinuz...@yahoo.com.ar --- units/systemd-udev-settle.service.in | 1 - units/systemd-udev-trigger.service.in | 1 -

Re: [systemd-devel] [PATCH] Drop ConditionCapability=CAP_MKNOD from *udev* units

2013-07-25 Thread Frederic Crozat
Le jeudi 25 juillet 2013 à 10:45 +0200, Thomas Bächler a écrit : Am 25.07.2013 10:18, schrieb Frederic Crozat: Le mercredi 24 juillet 2013 à 18:41 -0300, Gerardo Exequiel Pozzi a écrit : Signed-off-by: Gerardo Exequiel Pozzi vmlinuz...@yahoo.com.ar ---

Re: [systemd-devel] [PATCH] Drop ConditionCapability=CAP_MKNOD from *udev* units

2013-07-25 Thread Colin Guthrie
'Twas brillig, and Frederic Crozat at 25/07/13 09:54 did gyre and gimble: Le jeudi 25 juillet 2013 à 10:45 +0200, Thomas Bächler a écrit : Am 25.07.2013 10:18, schrieb Frederic Crozat: Le mercredi 24 juillet 2013 à 18:41 -0300, Gerardo Exequiel Pozzi a écrit : Signed-off-by: Gerardo Exequiel

Re: [systemd-devel] [PATCH] Drop ConditionCapability=CAP_MKNOD from *udev* units

2013-07-25 Thread Lennart Poettering
On Wed, 24.07.13 18:41, Gerardo Exequiel Pozzi (vmlinuz...@yahoo.com.ar) wrote: We generally try to make conditions specific to a feature rather than an execution environment. Containers should run without CAP_MKMNOD, and as udev originally was in the business of creating device nodes we hence

Re: [systemd-devel] [PATCH] Drop ConditionCapability=CAP_MKNOD from *udev* units

2013-07-25 Thread Lennart Poettering
On Thu, 25.07.13 10:45, Thomas Bächler (tho...@archlinux.org) wrote: Am 25.07.2013 10:18, schrieb Frederic Crozat: Le mercredi 24 juillet 2013 à 18:41 -0300, Gerardo Exequiel Pozzi a écrit : Signed-off-by: Gerardo Exequiel Pozzi vmlinuz...@yahoo.com.ar ---

Re: [systemd-devel] [PATCH] Drop ConditionCapability=CAP_MKNOD from *udev* units

2013-07-25 Thread Kay Sievers
On Thu, Jul 25, 2013 at 7:00 PM, Lennart Poettering lenn...@poettering.net wrote: I'd vote by replacing it by ConditionPathIsReadWrite=/sys since sane container managers mount that read-only.) A change like that sounds great to me. Keying-off access to /sys is probably more appropriate for

Re: [systemd-devel] [PATCH] Drop ConditionCapability=CAP_MKNOD from *udev* units

2013-07-25 Thread Gerardo Exequiel Pozzi
On 07/25/2013 02:00 PM, Lennart Poettering wrote: On Wed, 24.07.13 18:41, Gerardo Exequiel Pozzi (vmlinuz...@yahoo.com.ar) wrote: We generally try to make conditions specific to a feature rather than an execution environment. Containers should run without CAP_MKMNOD, and as udev originally

Re: [systemd-devel] [PATCH] Drop ConditionCapability=CAP_MKNOD from *udev* units

2013-07-25 Thread Kay Sievers
On Fri, Jul 26, 2013 at 12:19 AM, Gerardo Exequiel Pozzi vmlinuz...@yahoo.com.ar wrote: Anyway, I don't get what you are trying to achieve by your patch please elaborate. My thought was simple: Hey! what is doing CAP_MKNOD here since is not needed anymore for udev, remove them!. Ok course, I

Re: [systemd-devel] [PATCH] Drop ConditionCapability=CAP_MKNOD from *udev* units

2013-07-25 Thread Lennart Poettering
On Thu, 25.07.13 19:19, Gerardo Exequiel Pozzi (vmlinuz...@yahoo.com.ar) wrote: Anyway, I don't get what you are trying to achieve by your patch please elaborate. My thought was simple: Hey! what is doing CAP_MKNOD here since is not needed anymore for udev, remove them!. Ok course, I did