Source: runc
Version: 1.1.5+ds1-1+deb12u1
Severity: normal

Dear Maintainer,

runc 1.1.5 only generates device properties for devices with symlinks
in /dev/{char,block}/ in order to suppress warnings from systemd.
However, devices like those from NVIDIA (/dev/nvidiactl, /dev/nvidia0,
...) lack those symlinks and thus corresponding DeviceAllow rules are
never generated. This effects that NVIDIA devices inside containers can
no longer be accessed with operation not permitted errors after
systemctl daemon-reload has been executed which puts those device
access rules into effect. The bug is fixed upstream in [1]. The
backport requires minor context changes. We confirmed that the backport
fixes the observed behavior by appropriately generating DeviceAllow
rules for NVIDIA devices. NVIDIA devices then remain functional inside
containers also after executing systemctl daemon-reload.

Best regards
Tobias Preclik

[1]
https://github.com/opencontainers/runc/commit/d7208f59105e079ba037aea05f9d0603ba7f779f

Turns out the bug is fixed in trixie through the upstream commit

https://github.com/opencontainers/runc/commit/79a52b4349ead396cb70910d456de7ff1f118943

Analyzing the symlinks in /dev/{block,char} on a Bookworm-based machine
other device nodes also seem to lack symlinks:


MISSING  char  116:1 for /dev/snd/seq
MISSING  char  10:241 for /dev/vhost-vsock
MISSING  char  10:238 for /dev/vhost-net
MISSING  char  10:239 for /dev/uhid
MISSING  char  10:196 for /dev/vfio/vfio
MISSING  char  10:137 for /dev/vhci
MISSING  char  10:223 for /dev/uinput
MISSING  char  108:0 for /dev/ppp
MISSING  char  10:200 for /dev/net/tun
MISSING  char  10:144 for /dev/nvram
MISSING  char  10:203 for /dev/cuse

Thus increasing severity to important since other container use cases
such a qemu virtual machines with PCI passthrough are affected as well.


Best regards,
Tobias Preclik