kern_jail.c: Remove #ifdefs for VNET_NFSD
The consensus was that VNET_NFSD was not needed. This patch removes it from kern_jail.c. With this patch, support for the "allow.nfsd" jail parameter is enabled in the kernel for kernels built with "options VIMAGE". Reviewed by: markj MFC after: 3 months Differential Revision: https://reviews.freebsd.org/D38808
This commit is contained in:
parent
4bbbd5875d
commit
cbbb22031f
@ -219,7 +219,7 @@ static struct bool_flags pr_flag_allow[NBBY * NBPW] = {
|
|||||||
{"allow.unprivileged_proc_debug", "allow.nounprivileged_proc_debug",
|
{"allow.unprivileged_proc_debug", "allow.nounprivileged_proc_debug",
|
||||||
PR_ALLOW_UNPRIV_DEBUG},
|
PR_ALLOW_UNPRIV_DEBUG},
|
||||||
{"allow.suser", "allow.nosuser", PR_ALLOW_SUSER},
|
{"allow.suser", "allow.nosuser", PR_ALLOW_SUSER},
|
||||||
#if defined(VNET_NFSD) && defined(VIMAGE) && defined(NFSD)
|
#ifdef VIMAGE
|
||||||
{"allow.nfsd", "allow.nonfsd", PR_ALLOW_NFSD},
|
{"allow.nfsd", "allow.nonfsd", PR_ALLOW_NFSD},
|
||||||
#endif
|
#endif
|
||||||
};
|
};
|
||||||
@ -2136,12 +2136,10 @@ kern_jail_set(struct thread *td, struct uio *optuio, int flags)
|
|||||||
}
|
}
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
#ifdef VNET_NFSD
|
|
||||||
if (born && pr != &prison0 && (pr->pr_allow & PR_ALLOW_NFSD) != 0 &&
|
if (born && pr != &prison0 && (pr->pr_allow & PR_ALLOW_NFSD) != 0 &&
|
||||||
(pr->pr_root->v_vflag & VV_ROOT) == 0)
|
(pr->pr_root->v_vflag & VV_ROOT) == 0)
|
||||||
printf("Warning jail jid=%d: mountd/nfsd requires a separate"
|
printf("Warning jail jid=%d: mountd/nfsd requires a separate"
|
||||||
" file system\n", pr->pr_id);
|
" file system\n", pr->pr_id);
|
||||||
#endif
|
|
||||||
|
|
||||||
drflags &= ~PD_KILL;
|
drflags &= ~PD_KILL;
|
||||||
td->td_retval[0] = pr->pr_id;
|
td->td_retval[0] = pr->pr_id;
|
||||||
@ -3790,12 +3788,7 @@ prison_priv_check(struct ucred *cred, int priv)
|
|||||||
case PRIV_NFS_DAEMON:
|
case PRIV_NFS_DAEMON:
|
||||||
case PRIV_VFS_GETFH:
|
case PRIV_VFS_GETFH:
|
||||||
case PRIV_VFS_MOUNT_EXPORTED:
|
case PRIV_VFS_MOUNT_EXPORTED:
|
||||||
#ifdef VNET_NFSD
|
|
||||||
if (!prison_check_nfsd(cred))
|
if (!prison_check_nfsd(cred))
|
||||||
#else
|
|
||||||
printf("running nfsd in a prison requires a kernel "
|
|
||||||
"built with ''options VNET_NFSD''\n");
|
|
||||||
#endif
|
|
||||||
return (EPERM);
|
return (EPERM);
|
||||||
#ifdef notyet
|
#ifdef notyet
|
||||||
case PRIV_NFS_LOCKD:
|
case PRIV_NFS_LOCKD:
|
||||||
@ -4551,7 +4544,7 @@ SYSCTL_JAIL_PARAM(_allow, unprivileged_proc_debug, CTLTYPE_INT | CTLFLAG_RW,
|
|||||||
"B", "Unprivileged processes may use process debugging facilities");
|
"B", "Unprivileged processes may use process debugging facilities");
|
||||||
SYSCTL_JAIL_PARAM(_allow, suser, CTLTYPE_INT | CTLFLAG_RW,
|
SYSCTL_JAIL_PARAM(_allow, suser, CTLTYPE_INT | CTLFLAG_RW,
|
||||||
"B", "Processes in jail with uid 0 have privilege");
|
"B", "Processes in jail with uid 0 have privilege");
|
||||||
#if defined(VNET_NFSD) && defined(VIMAGE) && defined(NFSD)
|
#ifdef VIMAGE
|
||||||
SYSCTL_JAIL_PARAM(_allow, nfsd, CTLTYPE_INT | CTLFLAG_RW,
|
SYSCTL_JAIL_PARAM(_allow, nfsd, CTLTYPE_INT | CTLFLAG_RW,
|
||||||
"B", "Mountd/nfsd may run in the jail");
|
"B", "Mountd/nfsd may run in the jail");
|
||||||
#endif
|
#endif
|
||||||
|
Loading…
Reference in New Issue
Block a user