Actually only protect mount-point if security.jail.enforce_statfs is set to 2.
If we don't return statistics about requested file systems, system tools may not work correctly or at all. Approved by: re (scottl)
This commit is contained in:
parent
bc2e774a37
commit
06a137780b
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=147559
@ -331,9 +331,6 @@ linux_ustat(struct thread *td, struct linux_ustat_args *args)
|
||||
if (dev != NULL && vfinddev(dev, &vp)) {
|
||||
if (vp->v_mount == NULL)
|
||||
return (EINVAL);
|
||||
error = prison_canseemount(td->td_ucred, vp->v_mount);
|
||||
if (error)
|
||||
return (error);
|
||||
#ifdef MAC
|
||||
error = mac_check_mount_stat(td->td_ucred, vp->v_mount);
|
||||
if (error)
|
||||
|
@ -488,7 +488,6 @@ prison_enforce_statfs(struct ucred *cred, struct mount *mp, struct statfs *sp)
|
||||
return;
|
||||
pr = cred->cr_prison;
|
||||
if (prison_canseemount(cred, mp) != 0) {
|
||||
/* Should never happen. */
|
||||
bzero(sp->f_mntonname, sizeof(sp->f_mntonname));
|
||||
strlcpy(sp->f_mntonname, "[restricted]",
|
||||
sizeof(sp->f_mntonname));
|
||||
|
@ -257,11 +257,6 @@ kern_statfs(struct thread *td, char *path, enum uio_seg pathseg,
|
||||
sp = &mp->mnt_stat;
|
||||
NDFREE(&nd, NDF_ONLY_PNBUF);
|
||||
vrele(nd.ni_vp);
|
||||
error = prison_canseemount(td->td_ucred, mp);
|
||||
if (error) {
|
||||
mtx_unlock(&Giant);
|
||||
return (error);
|
||||
}
|
||||
#ifdef MAC
|
||||
error = mac_check_mount_stat(td->td_ucred, mp);
|
||||
if (error) {
|
||||
@ -335,11 +330,6 @@ kern_fstatfs(struct thread *td, int fd, struct statfs *buf)
|
||||
mtx_unlock(&Giant);
|
||||
return (EBADF);
|
||||
}
|
||||
error = prison_canseemount(td->td_ucred, mp);
|
||||
if (error) {
|
||||
mtx_unlock(&Giant);
|
||||
return (error);
|
||||
}
|
||||
#ifdef MAC
|
||||
error = mac_check_mount_stat(td->td_ucred, mp);
|
||||
if (error) {
|
||||
|
@ -257,11 +257,6 @@ kern_statfs(struct thread *td, char *path, enum uio_seg pathseg,
|
||||
sp = &mp->mnt_stat;
|
||||
NDFREE(&nd, NDF_ONLY_PNBUF);
|
||||
vrele(nd.ni_vp);
|
||||
error = prison_canseemount(td->td_ucred, mp);
|
||||
if (error) {
|
||||
mtx_unlock(&Giant);
|
||||
return (error);
|
||||
}
|
||||
#ifdef MAC
|
||||
error = mac_check_mount_stat(td->td_ucred, mp);
|
||||
if (error) {
|
||||
@ -335,11 +330,6 @@ kern_fstatfs(struct thread *td, int fd, struct statfs *buf)
|
||||
mtx_unlock(&Giant);
|
||||
return (EBADF);
|
||||
}
|
||||
error = prison_canseemount(td->td_ucred, mp);
|
||||
if (error) {
|
||||
mtx_unlock(&Giant);
|
||||
return (error);
|
||||
}
|
||||
#ifdef MAC
|
||||
error = mac_check_mount_stat(td->td_ucred, mp);
|
||||
if (error) {
|
||||
|
Loading…
Reference in New Issue
Block a user