fix: cgroups: ensure cgroups device limits are default allow

CHANGELOG.md

@@ -6,6 +6,7 @@
 
 - Correctly launch CleanupHost process only when needed in `--sif-fuse` flow.
 - Add specific error for unreadable image / overlay file.
+- Ensure cgroups device limits are default allow per past behavior.
 
 ## 3.10.0-rc.1 \[2022-05-04\]
 

e2e/cgroups/cgroups.go

@@ -97,9 +97,6 @@ func (c *ctx) instanceStats(t *testing.T, profile e2e.Profile) {
 					e2e.ExpectOutput(e2e.ContainMatch, "MEM %"),
 					e2e.ExpectOutput(e2e.ContainMatch, "BLOCK I/O"),
 					e2e.ExpectOutput(e2e.ContainMatch, "PIDS"),
-					e2e.ExpectOutput(e2e.ContainMatch, "GiB"),
-					e2e.ExpectOutput(e2e.ContainMatch, "KiB"),
-					e2e.ExpectOutput(e2e.ContainMatch, "MiB"),
 				),
 			)
 			c.env.RunSingularity(
@@ -303,6 +300,14 @@ func (c *ctx) actionApply(t *testing.T, profile e2e.Profile) {
 			// Reason is believed to be: https://github.com/opencontainers/runc/issues/3026
 			rootless: false,
 		},
+		// Device access is allowed by default.
+		{
+			name:            "device allow default",
+			args:            []string{"--apply-cgroups", "testdata/cgroups/null.toml", c.env.ImagePath, "cat", "/dev/null"},
+			expectErrorCode: 0,
+			rootfull:        true,
+			rootless:        true,
+		},
 		// Device limits are properly applied only in rootful mode. Rootless will ignore them with a warning.
 		{
 			name:            "device deny",

internal/pkg/cgroups/manager_linux.go

@@ -141,6 +141,14 @@ func (m *Manager) UpdateFromSpec(resources *specs.LinuxResources) (err error) {
 		return fmt.Errorf("could not create cgroup config: %w", err)
 	}
 
+	// runc/libcontainer/cgroups for v2 defaults to a deny-all policy, while
+	// singularity has always allowed access to devices by default. If no device
+	// rules are provided in the spec, then skip setting them so the deny-all is
+	// not applied.
+	if len(resources.Devices) == 0 {
+		lcConfig.SkipDevices = true
+	}
+
 	err = m.cgroup.Set(lcConfig.Resources)
 	if err != nil {
 		return fmt.Errorf("while setting cgroup limits: %w", err)
@@ -291,6 +299,14 @@ func newManager(resources *specs.LinuxResources, group string, systemd bool) (ma
 		return nil, fmt.Errorf("could not create cgroup config: %w", err)
 	}
 
+	// runc/libcontainer/cgroups for v2 defaults to a deny-all policy, while
+	// singularity has always allowed access to devices by default. If no device
+	// rules are provided in the spec, then skip setting them so the deny-all is
+	// not applied.
+	if len(resources.Devices) == 0 {
+		lcConfig.SkipDevices = true
+	}
+
 	cgroup, err := lcmanager.New(lcConfig)
 	if err != nil {
 		return nil, fmt.Errorf("while creating cgroup manager: %w", err)