systemd-nspawn /dev/dri/card0 权限

Question

我正在努力从 nspawn 容器访问/dev/dri/card0，但没有成功。有没有可能？

/etc/systemd/system/systemd-nspawn@centos7.service.d/override.conf:

[Service]
DeviceAllow=/dev/dri rw
DeviceAllow=/dev/shm rw
DeviceAllow=char-drm rw
ExecStart=
ExecStart=/usr/bin/systemd-nspawn --quiet --boot --link-journal=try-guest --network-veth -U --settings=override --machine=centos7 --capability=all

/etc/systemd/nspawn/centos7.nspawn:

[Exec]
Boot=yes
PrivateUsers=no

[Files]
Bind=/home/<user>
Bind=/tmp/.X11-unix
Bind=/cvmfs
Bind=/dev/shm
Bind=/dev/dri

[Network]
Private=no

在我的机器上：

$ strace -e open glxinfo
...
open("/dev/dri/card0", O_RDWR|O_CLOEXEC) = -1 EPERM (Operation not permitted)
...
$ ll /dev/dri/card0 
crw-rw----+ 1 root video 226, 0 Dec 13 11:55 /dev/dri/card0
$ groups
<user> wheel video

有没有办法让它工作？

Answer 1

解决了加行粗暴地拼凑

ExecStartPost=/bin/sh -c 'echo a > /sys/fs/cgroup/devices/machine.slice/machine-centos7.scope/devices.allow'

到/etc/systemd/system/systemd-nspawn@centos7.service.d/override.conf 文件。