systemd-nspawn - systemd-nspawn /dev/dri/card0 权限

Question

我正在努力/dev/dri/card0从 nspawn 容器访问但没有成功。甚至可能吗？

/etc/systemd/system/systemd-nspawn@centos7.service.d/override.conf：

[Service]
DeviceAllow=/dev/dri rw
DeviceAllow=/dev/shm rw
DeviceAllow=char-drm rw
ExecStart=
ExecStart=/usr/bin/systemd-nspawn --quiet --boot --link-journal=try-guest --network-veth -U --settings=override --machine=centos7 --capability=all

/etc/systemd/nspawn/centos7.nspawn：

[Exec]
Boot=yes
PrivateUsers=no

[Files]
Bind=/home/<user>
Bind=/tmp/.X11-unix
Bind=/cvmfs
Bind=/dev/shm
Bind=/dev/dri

[Network]
Private=no

在机器中我有：

$ strace -e open glxinfo
...
open("/dev/dri/card0", O_RDWR|O_CLOEXEC) = -1 EPERM (Operation not permitted)
...
$ ll /dev/dri/card0 
crw-rw----+ 1 root video 226, 0 Dec 13 11:55 /dev/dri/card0
$ groups
<user> wheel video

有没有办法让它工作？

Answer 1

通过添加线残酷地解决了 Kludged

ExecStartPost=/bin/sh -c 'echo a > /sys/fs/cgroup/devices/machine.slice/machine-centos7.scope/devices.allow'

到/etc/systemd/system/systemd-nspawn@centos7.service.d/override.conf文件。