Analogous to r232059, add a parameter for the ZFS file system:
allow.mount.zfs: allow mounting the zfs filesystem inside a jail This way the permssions for mounting all current VFCF_JAIL filesystems inside a jail are controlled wia allow.mount.* jail parameters. Update sysctl descriptions. Update jail(8) and zfs(8) manpages. TODO: document the connection of allow.mount.* and VFCF_JAIL for kernel developers MFC after: 10 days
This commit is contained in:
parent
6b93b90419
commit
e7af90ab00
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=232186
@ -24,7 +24,7 @@
|
||||
.\"
|
||||
.\" $FreeBSD$
|
||||
.\"
|
||||
.Dd November 26, 2011
|
||||
.Dd February 26, 2012
|
||||
.Dt ZFS 8
|
||||
.Os
|
||||
.Sh NAME
|
||||
@ -413,9 +413,15 @@ subcommand. You cannot attach a dataset to one jail and the children of the
|
||||
same dataset to another jails. To allow management of the dataset from within
|
||||
a jail, the
|
||||
.Sy jailed
|
||||
property has to be set. The
|
||||
property has to be set and the jail needs access to the
|
||||
.Pa /dev/zfs
|
||||
device. The
|
||||
.Sy quota
|
||||
property cannot be changed from within a jail.
|
||||
property cannot be changed from within a jail. See
|
||||
.Xr jail 8
|
||||
for information on how to allow mounting
|
||||
.Tn ZFS
|
||||
datasets from within a jail.
|
||||
.Pp
|
||||
.No A Tn ZFS
|
||||
dataset can be detached from a jail using the
|
||||
@ -2715,13 +2721,12 @@ to the jail identified by JID
|
||||
From now on this file system tree can be managed from within a jail if the
|
||||
.Sy jailed
|
||||
property has been set. To use this functionality, the jail needs the
|
||||
.Va enforce_statfs
|
||||
parameter set to
|
||||
.Sy 0
|
||||
and the
|
||||
.Va allow.mount
|
||||
parameter set to
|
||||
.Sy 1 .
|
||||
and
|
||||
.Va allow.mount.zfs
|
||||
parameters set to 1 and the
|
||||
.Va enforce_statfs
|
||||
parameter set to a value lower than 2.
|
||||
.Pp
|
||||
See
|
||||
.Xr jail 8
|
||||
|
@ -60,6 +60,7 @@
|
||||
#include <sys/dmu_objset.h>
|
||||
#include <sys/spa_boot.h>
|
||||
#include <sys/sa.h>
|
||||
#include <sys/jail.h>
|
||||
#include "zfs_comutil.h"
|
||||
|
||||
struct mtx zfs_debug_mtx;
|
||||
@ -1533,6 +1534,9 @@ zfs_mount(vfs_t *vfsp)
|
||||
int error = 0;
|
||||
int canwrite;
|
||||
|
||||
if (!prison_allow(td->td_ucred, PR_ALLOW_MOUNT_ZFS))
|
||||
return (EPERM);
|
||||
|
||||
if (vfs_getopt(vfsp->mnt_optnew, "from", (void **)&osname, NULL))
|
||||
return (EINVAL);
|
||||
|
||||
|
@ -203,6 +203,7 @@ static char *pr_allow_names[] = {
|
||||
"allow.socket_af",
|
||||
"allow.mount.devfs",
|
||||
"allow.mount.nullfs",
|
||||
"allow.mount.zfs",
|
||||
};
|
||||
const size_t pr_allow_names_size = sizeof(pr_allow_names);
|
||||
|
||||
@ -216,6 +217,7 @@ static char *pr_allow_nonames[] = {
|
||||
"allow.nosocket_af",
|
||||
"allow.mount.nodevfs",
|
||||
"allow.mount.nonullfs",
|
||||
"allow.mount.nozfs",
|
||||
};
|
||||
const size_t pr_allow_nonames_size = sizeof(pr_allow_nonames);
|
||||
|
||||
@ -4199,11 +4201,15 @@ SYSCTL_PROC(_security_jail, OID_AUTO, mount_allowed,
|
||||
SYSCTL_PROC(_security_jail, OID_AUTO, mount_devfs_allowed,
|
||||
CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
|
||||
NULL, PR_ALLOW_MOUNT_DEVFS, sysctl_jail_default_allow, "I",
|
||||
"Processes in jail can mount/unmount the devfs file system");
|
||||
"Processes in jail can mount the devfs file system");
|
||||
SYSCTL_PROC(_security_jail, OID_AUTO, mount_nullfs_allowed,
|
||||
CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
|
||||
NULL, PR_ALLOW_MOUNT_NULLFS, sysctl_jail_default_allow, "I",
|
||||
"Processes in jail can mount/unmount the nullfs file system");
|
||||
"Processes in jail can mount the nullfs file system");
|
||||
SYSCTL_PROC(_security_jail, OID_AUTO, mount_zfs_allowed,
|
||||
CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
|
||||
NULL, PR_ALLOW_MOUNT_ZFS, sysctl_jail_default_allow, "I",
|
||||
"Processes in jail can mount the zfs file system");
|
||||
|
||||
static int
|
||||
sysctl_jail_default_level(SYSCTL_HANDLER_ARGS)
|
||||
@ -4347,9 +4353,11 @@ SYSCTL_JAIL_PARAM_SUBNODE(allow, mount, "Jail mount/unmount permission flags");
|
||||
SYSCTL_JAIL_PARAM(_allow_mount, , CTLTYPE_INT | CTLFLAG_RW,
|
||||
"B", "Jail may mount/unmount jail-friendly file systems in general");
|
||||
SYSCTL_JAIL_PARAM(_allow_mount, devfs, CTLTYPE_INT | CTLFLAG_RW,
|
||||
"B", "Jail may mount/unmount the devfs file system");
|
||||
"B", "Jail may mount the devfs file system");
|
||||
SYSCTL_JAIL_PARAM(_allow_mount, nullfs, CTLTYPE_INT | CTLFLAG_RW,
|
||||
"B", "Jail may mount/unmount the nullfs file system");
|
||||
"B", "Jail may mount the nullfs file system");
|
||||
SYSCTL_JAIL_PARAM(_allow_mount, zfs, CTLTYPE_INT | CTLFLAG_RW,
|
||||
"B", "Jail may mount the zfs file system");
|
||||
|
||||
void
|
||||
prison_racct_foreach(void (*callback)(struct racct *racct,
|
||||
|
@ -225,7 +225,8 @@ struct prison_racct {
|
||||
#define PR_ALLOW_SOCKET_AF 0x0040
|
||||
#define PR_ALLOW_MOUNT_DEVFS 0x0080
|
||||
#define PR_ALLOW_MOUNT_NULLFS 0x0100
|
||||
#define PR_ALLOW_ALL 0x01ff
|
||||
#define PR_ALLOW_MOUNT_ZFS 0x0200
|
||||
#define PR_ALLOW_ALL 0x03ff
|
||||
|
||||
/*
|
||||
* OSD methods
|
||||
|
@ -34,7 +34,7 @@
|
||||
.\"
|
||||
.\" $FreeBSD$
|
||||
.\"
|
||||
.Dd February 23, 2012
|
||||
.Dd February 26, 2012
|
||||
.Dt JAIL 8
|
||||
.Os
|
||||
.Sh NAME
|
||||
@ -427,6 +427,17 @@ This permission is effective only together with
|
||||
and if
|
||||
.Va enforce_statfs
|
||||
is set to a value lower than 2.
|
||||
.It Va allow.mount.zfs
|
||||
privileged users inside the jail will be able to mount and unmount the
|
||||
ZFS file system.
|
||||
This permission is effective only together with
|
||||
.Va allow.mount
|
||||
and if
|
||||
.Va enforce_statfs
|
||||
is set to a value lower than 2. See
|
||||
.Xr zfs 8
|
||||
for information on how to configure the ZFS filesystem to operate from
|
||||
within a jail.
|
||||
.It Va allow.quotas
|
||||
The prison root may administer quotas on the jail's filesystem(s).
|
||||
This includes filesystems that the jail may share with other jails or
|
||||
|
Loading…
Reference in New Issue
Block a user