d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Make the "enforce_statfs" default 2 (most restrictive) in jail_set(2),

Browse Source 
instead of whatever the parent/system has (which is generally 0).  This
mirrors the old-style default used for jail(2) in conjunction with the
security.jail.enforce_statfs sysctl.

Approved by:	re (kib), bz (mentor)
This commit is contained in:
jamie 2009-07-31 16:00:41 +00:00
parent f3a133a1c3
commit e87d51a605
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
sys/kern/kern_jail.c
View File

@ -165,9 +165,10 @@ static char *pr_allow_nonames[] = {
"allow.nosocket_af",
};
#define JAIL_DEFAULT_ALLOW PR_ALLOW_SET_HOSTNAME
#define JAIL_DEFAULT_ALLOW PR_ALLOW_SET_HOSTNAME
#define JAIL_DEFAULT_ENFORCE_STATFS 2
static unsigned jail_default_allow = JAIL_DEFAULT_ALLOW;
static int jail_default_enforce_statfs = 2;
static int jail_default_enforce_statfs = JAIL_DEFAULT_ENFORCE_STATFS;
#if defined(INET) || defined(INET6)
static unsigned jail_max_af_ips = 255;
#endif
@ -1181,7 +1182,7 @@ kern_jail_set(struct thread *td, struct uio *optuio, int flags)
#endif
pr->pr_securelevel = ppr->pr_securelevel;
pr->pr_allow = JAIL_DEFAULT_ALLOW & ppr->pr_allow;
pr->pr_enforce_statfs = ppr->pr_enforce_statfs;
pr->pr_enforce_statfs = JAIL_DEFAULT_ENFORCE_STATFS;
LIST_INIT(&pr->pr_children);
mtx_init(&pr->pr_mtx, "jail mutex", NULL, MTX_DEF | MTX_DUPOK);