d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

krpc: Allow mountd/nfsd to optionally run in a jail

Browse Source 
This patch modifies the kernel RPC so that it will allow
mountd/nfsd to run inside of a vnet jail.  Running mountd/nfsd
inside a vnet jail will be enabled via a new kernel build
option called VNET_NFSD, which will be implemented in future
commits.

Although I suspect cr_prison can be set from the credentials
of the current thread unconditionally, I #ifdef'd the code
VNET_NFSD and only did this for the jailed case mainly to
document that it is only needed for use in a jail.

The TLS support code has not yet been modified to work in
a jail.  That is planned as future development after the
basic VNET_NFSD support is in the kernel.

This patch should not result in any semantics change until
VNET_NFSD is implemented and used in a kernel configuration.

MFC after:	4 months
This commit is contained in:
Rick Macklem 2022-12-18 12:40:48 -08:00
parent a48301a5e0
commit 6a76d35cac
4 changed files with 25 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
sys/rpc/rpcsec_gss/svc_rpcsec_gss.c
View File

@ -478,7 +478,12 @@ rpc_gss_svc_getcred(struct svc_req *req, struct ucred **crp, int *flavorp)
cr->cr_uid = cr->cr_ruid = cr->cr_svuid = uc->uid;
cr->cr_rgid = cr->cr_svgid = uc->gid;
crsetgroups(cr, uc->gidlen, uc->gidlist);
cr->cr_prison = &prison0;
#ifdef VNET_NFSD
if (jailed(curthread->td_ucred))
cr->cr_prison = curthread->td_ucred->cr_prison;
else
#endif
cr->cr_prison = &prison0;
prison_hold(cr->cr_prison);
*crp = crhold(cr);

3
sys/rpc/svc.c
View File

@ -48,6 +48,7 @@ __FBSDID("$FreeBSD$");
*/
#include <sys/param.h>
#include <sys/jail.h>
#include <sys/lock.h>
#include <sys/kernel.h>
#include <sys/kthread.h>
@ -126,7 +127,7 @@ svcpool_create(const char *name, struct sysctl_oid_list *sysctl_base)
pool->sp_space_low = (pool->sp_space_high / 3) * 2;
sysctl_ctx_init(&pool->sp_sysctl);
if (sysctl_base) {
if (!jailed(curthread->td_ucred) && sysctl_base) {
SYSCTL_ADD_PROC(&pool->sp_sysctl, sysctl_base, OID_AUTO,
"minthreads", CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
pool, 0, svcpool_minthread_sysctl, "I",

15
sys/rpc/svc_auth.c
View File

@ -48,6 +48,7 @@ __FBSDID("$FreeBSD$");
#include <sys/param.h>
#include <sys/lock.h>
#include <sys/mutex.h>
#include <sys/proc.h>
#include <sys/systm.h>
#include <sys/jail.h>
#include <sys/ucred.h>
@ -197,7 +198,12 @@ svc_getcred(struct svc_req *rqst, struct ucred **crp, int *flavorp)
cr->cr_uid = cr->cr_ruid = cr->cr_svuid = xprt->xp_uid;
crsetgroups(cr, xprt->xp_ngrps, xprt->xp_gidp);
cr->cr_rgid = cr->cr_svgid = xprt->xp_gidp[0];
cr->cr_prison = &prison0;
#ifdef VNET_NFSD
if (jailed(curthread->td_ucred))
cr->cr_prison = curthread->td_ucred->cr_prison;
else
#endif
cr->cr_prison = &prison0;
prison_hold(cr->cr_prison);
*crp = cr;
return (TRUE);
@ -210,7 +216,12 @@ svc_getcred(struct svc_req *rqst, struct ucred **crp, int *flavorp)
cr->cr_uid = cr->cr_ruid = cr->cr_svuid = xcr->cr_uid;
crsetgroups(cr, xcr->cr_ngroups, xcr->cr_groups);
cr->cr_rgid = cr->cr_svgid = cr->cr_groups[0];
cr->cr_prison = &prison0;
#ifdef VNET_NFSD
if (jailed(curthread->td_ucred))
cr->cr_prison = curthread->td_ucred->cr_prison;
else
#endif
cr->cr_prison = &prison0;
prison_hold(cr->cr_prison);
*crp = cr;
return (TRUE);

4
sys/rpc/svc_dg.c
View File

@ -45,11 +45,13 @@ __FBSDID("$FreeBSD$");
*/
#include <sys/param.h>
#include <sys/jail.h>
#include <sys/lock.h>
#include <sys/kernel.h>
#include <sys/malloc.h>
#include <sys/mbuf.h>
#include <sys/mutex.h>
#include <sys/proc.h>
#include <sys/protosw.h>
#include <sys/queue.h>
#include <sys/socket.h>
@ -104,6 +106,8 @@ svc_dg_create(SVCPOOL *pool, struct socket *so, size_t sendsize,
struct sockaddr* sa;
int error;
if (jailed(curthread->td_ucred))
return (NULL);
if (!__rpc_socket2sockinfo(so, &si)) {
printf(svc_dg_str, svc_dg_err1);
return (NULL);