osbuild.pi: grant access to loop device nodes

We are in the devices namespace, so we must explicitly grant
permission to devices and/or device classes if we are to use
them.

We rely on being able to create and access loop devices in
order to create partitions and filesystems.

/dev/loop-control allows us to create new loop devices backed by
files. The block-loop class allows access to the created block
devices to set up a partition table and the block-blkext class
allows access to the partitions to create and mount filesystems.

Signed-off-by: Tom Gundersen <teg@jklm.no>

osbuild.py

@@ -85,6 +85,9 @@ class BuildRoot:
             "--as-pid2",
             "--link-journal=no",
             "--volatile=yes",
+            "--property=DeviceAllow=/dev/loop-control rw",
+            "--property=DeviceAllow=block-loop rw",
+            "--property=DeviceAllow=block-blkext rw",
             f"--machine={self.machine_name}",
             f"--directory={self.root}",
             f"--bind={libdir}/osbuild-run:/run/osbuild/osbuild-run",