Add /sys/dev as a masked path path
If the container is not privileged, mask the /sys/dev
path so that we don't leak extra devices in a container.
@@ -487,6 +487,7 @@ func (s *Server) createSandboxContainer(ctx context.Context, ctr ctrIface.Contai
"/proc/sched_debug",
"/proc/scsi",
"/sys/firmware",
+ "/sys/dev",
} {
specgen.AddLinuxMaskedPaths(mp)
}
