add device-remove-all potion

Signed-off-by: zhouhao <[email protected]>

Author: zhouhao

cmd/oci-runtime-tool/generate.go

@@ -28,6 +28,7 @@ var generateFlags = []cli.Flag{
 	cli.StringFlag{Name: "cwd", Value: "/", Usage: "current working directory for the process"},
 	cli.StringSliceFlag{Name: "device-add", Usage: "add a device which must be made available in the container"},
 	cli.StringSliceFlag{Name: "device-remove", Usage: "remove a device which must be made available in the container"},
+	cli.StringSliceFlag{Name: "device-remove-all", Usage: "remove all devices which must be made available in the container"},
 	cli.BoolFlag{Name: "disable-oom-kill", Usage: "disable OOM Killer"},
 	cli.StringSliceFlag{Name: "env", Usage: "add environment variable e.g. key=value"},
 	cli.StringSliceFlag{Name: "env-file", Usage: "read in a file of environment variables"},
@@ -529,6 +530,11 @@ func setupSpec(g *generate.Generator, context *cli.Context) error {
 		}
 	}
 
+
+	if context.Bool("device-remove-all") {
+		g.ClearLinuxDevices()
+	}
+
 	err := addSeccomp(context, g)
 	return err
 }

completions/bash/oci-runtime-tool

@@ -364,6 +364,7 @@ _oci-runtime-tool_generate() {
 	"
 
 	local boolean_options="
+		--device-remove-all
 		--disable-oom-kill
 		--linux-namespace-remove-all
 		--no-new-privileges

generate/generate.go

@@ -936,6 +936,15 @@ func (g *Generator) RemoveDevice(dev rspec.Device) error {
 	return nil
 }
 
+// ClearLinuxDevices clear g.spec.Linux.Devices.
+func (g *Generator) ClearLinuxDevices() {
+	if g.spec == nil || g.spec.Linux == nil || g.spec.Linux.Devices == nil {
+		return
+	}
+
+	g.spec.Linux.Devices = []rspec.Device{}
+}
+
 // strPtr returns the pointer pointing to the string s.
 func strPtr(s string) *string { return &s }
 

man/oci-runtime-tool-generate.1.md

@@ -66,6 +66,9 @@ read the configuration from `config.json`.
   Remove a device file in container.
   This option can be specified multiple times.
 
+**--device-remove-all**=true|false
+  Remove all devices for linux inside the container. The default is *false*.
+
 **--disable-oom-kill**=true|false
   Whether to disable OOM Killer for the container or not.