d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Allow tmpfs be mounted inside jail.

Browse Source
This commit is contained in:
Xin LI 2013-08-23 22:52:20 +00:00
parent c7e7c22e16
commit 2454886e05
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=254741
4 changed files with 26 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
sys/fs/tmpfs/tmpfs_vfsops.c
View File

@ -47,6 +47,8 @@ __FBSDID("$FreeBSD$");
#include <sys/limits.h>
#include <sys/lock.h>
#include <sys/mutex.h>
#include <sys/proc.h>
#include <sys/jail.h>
#include <sys/kernel.h>
#include <sys/stat.h>
#include <sys/systm.h>
@ -138,6 +140,7 @@ tmpfs_mount(struct mount *mp)
sizeof(struct tmpfs_dirent) + sizeof(struct tmpfs_node));
struct tmpfs_mount *tmp;
struct tmpfs_node *root;
struct thread *td = curthread;
int error;
/* Size counters. */
u_quad_t pages;
@ -150,6 +153,9 @@ tmpfs_mount(struct mount *mp)
struct vattr va;
if (!prison_allow(td->td_ucred, PR_ALLOW_MOUNT_TMPFS))
return (EPERM);
if (vfs_filteropt(mp->mnt_optnew, tmpfs_opts))
return (EINVAL);
@ -420,4 +426,4 @@ struct vfsops tmpfs_vfsops = {
.vfs_statfs = tmpfs_statfs,
.vfs_fhtovp = tmpfs_fhtovp,
};
VFS_SET(tmpfs_vfsops, tmpfs, 0);
VFS_SET(tmpfs_vfsops, tmpfs, VFCF_JAIL);

8
sys/kern/kern_jail.c
View File

@ -206,6 +206,7 @@ static char *pr_allow_names[] = {
"allow.mount.nullfs",
"allow.mount.zfs",
"allow.mount.procfs",
"allow.mount.tmpfs",
};
const size_t pr_allow_names_size = sizeof(pr_allow_names);
@ -221,6 +222,7 @@ static char *pr_allow_nonames[] = {
"allow.mount.nonullfs",
"allow.mount.nozfs",
"allow.mount.noprocfs",
"allow.mount.notmpfs",
};
const size_t pr_allow_nonames_size = sizeof(pr_allow_nonames);
@ -4228,6 +4230,10 @@ SYSCTL_PROC(_security_jail, OID_AUTO, mount_procfs_allowed,
CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
NULL, PR_ALLOW_MOUNT_PROCFS, sysctl_jail_default_allow, "I",
"Processes in jail can mount the procfs file system");
SYSCTL_PROC(_security_jail, OID_AUTO, mount_tmpfs_allowed,
CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
NULL, PR_ALLOW_MOUNT_TMPFS, sysctl_jail_default_allow, "I",
"Processes in jail can mount the tmpfs file system");
SYSCTL_PROC(_security_jail, OID_AUTO, mount_zfs_allowed,
CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
NULL, PR_ALLOW_MOUNT_ZFS, sysctl_jail_default_allow, "I",
@ -4380,6 +4386,8 @@ SYSCTL_JAIL_PARAM(_allow_mount, nullfs, CTLTYPE_INT | CTLFLAG_RW,
"B", "Jail may mount the nullfs file system");
SYSCTL_JAIL_PARAM(_allow_mount, procfs, CTLTYPE_INT | CTLFLAG_RW,
"B", "Jail may mount the procfs file system");
SYSCTL_JAIL_PARAM(_allow_mount, tmpfs, CTLTYPE_INT | CTLFLAG_RW,
"B", "Jail may mount the tmpfs file system");
SYSCTL_JAIL_PARAM(_allow_mount, zfs, CTLTYPE_INT | CTLFLAG_RW,
"B", "Jail may mount the zfs file system");

3
sys/sys/jail.h
View File

@ -227,7 +227,8 @@ struct prison_racct {
#define PR_ALLOW_MOUNT_NULLFS 0x0100
#define PR_ALLOW_MOUNT_ZFS 0x0200
#define PR_ALLOW_MOUNT_PROCFS 0x0400
#define PR_ALLOW_ALL 0x07ff
#define PR_ALLOW_MOUNT_TMPFS 0x0800
#define PR_ALLOW_ALL 0x0fff
/*
* OSD methods

10
usr.sbin/jail/jail.8
View File

@ -25,7 +25,7 @@
.\"
.\" $FreeBSD$
.\"
.Dd September 15, 2012
.Dd August 23, 2013
.Dt JAIL 8
.Os
.Sh NAME
@ -545,6 +545,14 @@ This permission is effective only together with
and if
.Va enforce_statfs
is set to a value lower than 2.
.It Va allow.mount.tmpfs
privileged users inside the jail will be able to mount and unmount the
tmpfs file system.
This permission is effective only together with
.Va allow.mount
and if
.Va enforce_statfs
is set to a value lower than 2.
.It Va allow.mount.zfs
privileged users inside the jail will be able to mount and unmount the
ZFS file system.