block device should be set rw before hotplug test if qemu version above 5.1

[jongwu]

using qemu 5.1+
docker run --rm --runtime kata-runtime --device /dev/loop0 ubuntu ls

error log:
docker: Error response from daemon: OCI runtime create failed: QMP command failed: 649: The device is not writable: Permission denied: unknown.
also refer to http://jenkins.katacontainers.io/job/kata-containers-runtime-ARM-18.04-PR/1845/consoleFull
test case:
[docker run --cidfile /tmp/cid416376284/NJtkQ8Id9H5gAEftsXIlRx7IDoshP1 --runtime kata-runtime --device /dev/loop2 --device /dev/loop3 --device /dev/loop4 --device /dev/loop5 --device /dev/loop6 --device /dev/loop7 --device /dev/loop8 --device /dev/loop9 --device /dev/loop10 --device /dev/loop11 --rm --name NJtkQ8Id9H5gAEftsXIlRx7IDoshP1 busybox stat /dev/loop2 /dev/loop3 /dev/loop4 /dev/loop5 /dev/loop6 /dev/loop7 /dev/loop8 /dev/loop9 /dev/loop10 /dev/loop11]

error log:
docker: Error response from daemon: OCI runtime create failed: rpc error: code = DeadlineExceeded desc = Timeout reached after 3s waiting for device 0:0:0:0/block: unknown.

[fighterhit]

when I use the kubevirt-gpu-device-plugin to pass through NVIDIA GPU to the kata container, it seems also report the similar error.

 Error: failed to create containerd task: failed to create shim: QMP command failed: The device is not writable: Permission denied: unknown 

But I have checked that the device plugin code has set the file to rw mode.

https://github.com/NVIDIA/kubevirt-gpu-device-plugin/blob/531e81bb28738507315249ba5b27847ddadceeed/pkg/device_plugin/generic_device_plugin.go#L258

https://github.com/NVIDIA/kubevirt-gpu-device-plugin/blob/531e81bb28738507315249ba5b27847ddadceeed/pkg/device_plugin/generic_device_plugin.go#L263

[fighterhit]

when I use the kubevirt-gpu-device-plugin to pass through NVIDIA GPU to the kata container, it seems also report the similar error.

 Error: failed to create containerd task: failed to create shim: QMP command failed: The device is not writable: Permission denied: unknown 

But I have checked that the device plugin code has set the file to rw mode.

https://github.com/NVIDIA/kubevirt-gpu-device-plugin/blob/531e81bb28738507315249ba5b27847ddadceeed/pkg/device_plugin/generic_device_plugin.go#L258

https://github.com/NVIDIA/kubevirt-gpu-device-plugin/blob/531e81bb28738507315249ba5b27847ddadceeed/pkg/device_plugin/generic_device_plugin.go#L263

I found it's failure when I set privileged is true but normal when I add ALL capabilities,that's is

//failure
securityContext:
  privileged: true


//success
securityContext:
  capabilities:
    add:
    - ALL