From owner-freebsd-jail@FreeBSD.ORG Sun May 5 01:00:34 2013 Return-Path: Delivered-To: jail@FreeBSD.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by hub.freebsd.org (Postfix) with ESMTP id 6B962BE0; Sun, 5 May 2013 01:00:34 +0000 (UTC) (envelope-from jase@FreeBSD.org) Received: from svr06-mx.btshosting.co.uk (mx-2.btshosting.co.uk [IPv6:2a01:4f8:121:2403:2::]) by mx1.freebsd.org (Postfix) with ESMTP id 2C5698E5; Sun, 5 May 2013 01:00:31 +0000 (UTC) Received: from [192.168.1.65] (unknown [2.222.62.37]) (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (No client certificate requested) by svr06-mx.btshosting.co.uk (Postfix) with ESMTPSA id F02E36F649; Sun, 5 May 2013 01:00:21 +0000 (UTC) Message-ID: <5185AF20.5010308@FreeBSD.org> Date: Sun, 05 May 2013 02:00:16 +0100 From: Jase Thew Organization: The FreeBSD Project User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:17.0) Gecko/20130328 Thunderbird/17.0.5 MIME-Version: 1.0 To: Baptiste Daroussin Subject: Re: Marking some FS as jailable References: <20130212194047.GE12760@ithaqua.etoilebsd.net> <511B1F55.3080500@FreeBSD.org> <20130214132715.GG44004@ithaqua.etoilebsd.net> <511CF77A.2080005@FreeBSD.org> <20130214145600.GI44004@ithaqua.etoilebsd.net> <511CFBAC.3000803@FreeBSD.org> <20130214150857.GK44004@ithaqua.etoilebsd.net> In-Reply-To: <20130214150857.GK44004@ithaqua.etoilebsd.net> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Cc: jail@FreeBSD.org, fs@FreeBSD.org, Jamie Gritton X-BeenThere: freebsd-jail@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Discussion about FreeBSD jail\(8\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 05 May 2013 01:00:34 -0000 On 14/02/2013 15:08, Baptiste Daroussin wrote: > On Thu, Feb 14, 2013 at 07:58:52AM -0700, Jamie Gritton wrote: >> On 02/14/13 07:56, Baptiste Daroussin wrote: >>> On Thu, Feb 14, 2013 at 07:40:58AM -0700, Jamie Gritton wrote: >>>> On 02/14/13 06:27, Baptiste Daroussin wrote: >>>>> On Tue, Feb 12, 2013 at 10:06:29PM -0700, Jamie Gritton wrote: >>>>>> On 02/12/13 12:40, Baptiste Daroussin wrote: >>>>>>> >>>>>>> I would like to mark some filesystem as jailable, here is the one I need: >>>>>>> linprocfs, tmpfs and fdescfs, I was planning to do it with adding a >>>>>>> allow.mount.${fs} for each one. >>>>>>> >>>>>>> Anyone has an objection? >>>>>> >>>>>> Would it make sense for linprocfs to use the existing allow.mount.procfs >>>>>> flag? >>>>> >>>>> Here is a patch that uses allow.mount.procfs for linsysfs and linprocfs. >>>>> >>>>> It also addd a new allow.mount.tmpfs to allow tmpfs. >>>>> >>>>> It seems to work here, can anyone confirm this is the right way to do it? >>>>> >>>>> I'll commit in 2 parts: first lin*fs, second tmpfs related things >>>>> >>>>> http://people.freebsd.org/~bapt/jail-fs.diff >>>> >>>> There are some problems. The usage on the mount side of things looks >>>> correct, but it needs more on the jail side. I'm including a patch just >>>> of that part, with a correction in jail.h and further changes in kern_jail.c >>> >>> Thank you the patch has been updated with your fixes. >> >> One more bit (literally): PR_ALLOW_ALL in sys/jail.h needs updating. >> >> - Jamie > > Fixed thanks > > Bapt > Hi, Is this functionality likely to make its way into HEAD and if so, do you have any idea as to the timescale? Regards, Jase. -- Jase Thew jase@FreeBSD.org FreeBSD Ports Committer