From nobody Sat Dec 17 21:45:27 2022 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4NZKJl4GXGz1GCW6; Sat, 17 Dec 2022 21:45:27 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4NZKJl3hYlz3CFb; Sat, 17 Dec 2022 21:45:27 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1671313527; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=j0ceXZ57u2Cd3wwSzqmBM6HtQd3WymJCMk5QY2YMgtE=; b=jd1RU2qicAjCzV6T+25d/jQKuHLfLbeluFLwsI16aKGAlj6K6ZDamCaVMDb0lwSZHUKuas ktZizqSSivfR/xAJHAFFRqPsQOl7RtH7WIq+doKp06QYpIKiWT31WAk8IIHCRRgGMmK825 80q3vftmnqY4dQwiQ+EazuEcV/wZ4KnC8Y3j17615iIxyfdE1XmjDKjOIdAFgaSEeIvzj4 oyGle7AwoWq3kwqdNEFRcYdnfahgOLZzWuxgsWX9sbDo7BPieMjwdOjlv8aFZNMmoQkXlM nNjBVdWwvitrwE5ps08MmBMNrnyA1AWHJoa/h1YzskqjHk8YW7c6CkNJ7F8+qw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1671313527; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=j0ceXZ57u2Cd3wwSzqmBM6HtQd3WymJCMk5QY2YMgtE=; b=LSb/XWihEfNNKdfpom2/LKLFrRHXlwqIWD9F19BJk13GP2FcdiPGDl1cYJIhj21MpBkXFC J52Pj5OyfZxC/xP5m+7nPDvlnrcaC27MfkKV+zrtgr5VjdJKRenQi0w0t42ZkC8kzRBThe xYOn7ygSpvDUfT9as0X6iAgaxnzk8y9rUTfFyZyxV1cJ4ZVrtOCHDFxNb6Fz3vFhnuPUkJ OMufOwLhfXcqacw08KmmrG98/QHt9nqyq3QdN39NE3paGz8USTtDQXxalpV3X4q0e+MQ6e 1aCajo/0XARAnPh/h/o+ZmCx6GmgwYrsn05G1GHKJ9e3ZhbyLzMHW7Eo0/Lwdg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1671313527; a=rsa-sha256; cv=none; b=Fazya3bMR754zq5CCRREZVj1NRyp8wo6KgngJLM9GfXPUwx9y/5RFQpd8soyXxe50Oxo3J IBtPEntUrUMyLHuNrFnb1By9Byf6yk952LXb1pyJ3b80b7gURrbtc05RMr1xC/28un47yy Hy7yWBl5Ecs9Z0lqj2kqHmudJdnaXH/wnQocePawMpsJUSnKnFuRJcyBCaQDH/WCY694lB FEv7ATwGBNF7J9sD/iIqAxDB8Dm/G65qtSS16Ysuy9QUe4cpRIjroDFjAQnhzNxiXDY0cC exh8RRIkaCV60PKT6WpLOFD7DvCCTUA1MVdk+yP3i4TeGjS+TGbNFTgDqMAgMw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4NZKJl2kjdz16cq; Sat, 17 Dec 2022 21:45:27 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 2BHLjRlU086777; Sat, 17 Dec 2022 21:45:27 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 2BHLjRk0086776; Sat, 17 Dec 2022 21:45:27 GMT (envelope-from git) Date: Sat, 17 Dec 2022 21:45:27 GMT Message-Id: <202212172145.2BHLjRk0086776@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Rick Macklem Subject: git: bba7a2e89602 - main - kern_jail.c: Allow mountd/nfsd to optionally run in a jail List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: rmacklem X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: bba7a2e89602e6745bb2ec474f5ab714aef49f42 Auto-Submitted: auto-generated X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by rmacklem: URL: https://cgit.FreeBSD.org/src/commit/?id=bba7a2e89602e6745bb2ec474f5ab714aef49f42 commit bba7a2e89602e6745bb2ec474f5ab714aef49f42 Author: Rick Macklem AuthorDate: 2022-12-17 21:43:49 +0000 Commit: Rick Macklem CommitDate: 2022-12-17 21:43:49 +0000 kern_jail.c: Allow mountd/nfsd to optionally run in a jail This patch adds "allow.nfsd" to the jail code based on a new kernel build option VNET_NFSD. This will not work until future patches fix nmount(2) to allow mountd to run in a vnet prison and the NFS server code is patched so that global variables are in a vnet. The jail(8) man page will be patched in a future commit. Reviewed by: jamie MFC after: 4 months Differential Revision: https://reviews.freebsd.org/D37637 --- sys/kern/kern_jail.c | 47 ++++++++++++++++++++++++++++++++++++++++++++++- sys/sys/jail.h | 4 +++- 2 files changed, 49 insertions(+), 2 deletions(-) diff --git a/sys/kern/kern_jail.c b/sys/kern/kern_jail.c index 8e9cdadd94cd..705d90aecdf8 100644 --- a/sys/kern/kern_jail.c +++ b/sys/kern/kern_jail.c @@ -34,6 +34,7 @@ __FBSDID("$FreeBSD$"); #include "opt_ddb.h" #include "opt_inet.h" #include "opt_inet6.h" +#include "opt_nfs.h" #include #include @@ -218,6 +219,9 @@ static struct bool_flags pr_flag_allow[NBBY * NBPW] = { {"allow.unprivileged_proc_debug", "allow.nounprivileged_proc_debug", PR_ALLOW_UNPRIV_DEBUG}, {"allow.suser", "allow.nosuser", PR_ALLOW_SUSER}, +#if defined(VNET_NFSD) && defined(VIMAGE) && defined(NFSD) + {"allow.nfsd", "allow.nonfsd", PR_ALLOW_NFSD}, +#endif }; static unsigned pr_allow_all = PR_ALLOW_ALL_STATIC; const size_t pr_flag_allow_size = sizeof(pr_flag_allow); @@ -2102,6 +2106,13 @@ kern_jail_set(struct thread *td, struct uio *optuio, int flags) } #endif +#ifdef VNET_NFSD + if (born && pr != &prison0 && (pr->pr_allow & PR_ALLOW_NFSD) != 0 && + (pr->pr_root->v_vflag & VV_ROOT) == 0) + printf("Warning jail jid=%d: mountd/nfsd requires a separate" + " file system\n", pr->pr_id); +#endif + drflags &= ~PD_KILL; td->td_retval[0] = pr->pr_id; @@ -3463,6 +3474,27 @@ prison_check(struct ucred *cred1, struct ucred *cred2) prison_ischild(cred1->cr_prison, cred2->cr_prison)) ? 0 : ESRCH); } +/* + * For mountd/nfsd to run within a prison, it must be: + * - A vnet prison. + * - PR_ALLOW_NFSD must be set on it. + * - The root directory (pr_root) of the prison must be + * a file system mount point, so the mountd can hang + * export information on it. + */ +bool +prison_check_nfsd(struct ucred *cred) +{ + + if (jailed_without_vnet(cred)) + return (false); + if (!prison_allow(cred, PR_ALLOW_NFSD)) + return (false); + if ((cred->cr_prison->pr_root->v_vflag & VV_ROOT) == 0) + return (false); + return (true); +} + /* * Return 1 if p2 is a child of p1, otherwise 0. */ @@ -3717,11 +3749,20 @@ prison_priv_check(struct ucred *cred, int priv) * is only granted conditionally in the legacy jail case. */ switch (priv) { -#ifdef notyet /* * NFS-specific privileges. */ case PRIV_NFS_DAEMON: + case PRIV_VFS_GETFH: + case PRIV_VFS_MOUNT_EXPORTED: +#ifdef VNET_NFSD + if (!prison_check_nfsd(cred)) +#else + printf("running nfsd in a prison requires a kernel " + "built with ''options VNET_NFSD''\n"); +#endif + return (EPERM); +#ifdef notyet case PRIV_NFS_LOCKD: #endif /* @@ -4474,6 +4515,10 @@ SYSCTL_JAIL_PARAM(_allow, unprivileged_proc_debug, CTLTYPE_INT | CTLFLAG_RW, "B", "Unprivileged processes may use process debugging facilities"); SYSCTL_JAIL_PARAM(_allow, suser, CTLTYPE_INT | CTLFLAG_RW, "B", "Processes in jail with uid 0 have privilege"); +#if defined(VNET_NFSD) && defined(VIMAGE) && defined(NFSD) +SYSCTL_JAIL_PARAM(_allow, nfsd, CTLTYPE_INT | CTLFLAG_RW, + "B", "Mountd/nfsd may run in the jail"); +#endif SYSCTL_JAIL_PARAM_SUBNODE(allow, mount, "Jail mount/unmount permission flags"); SYSCTL_JAIL_PARAM(_allow_mount, , CTLTYPE_INT | CTLFLAG_RW, diff --git a/sys/sys/jail.h b/sys/sys/jail.h index 743b413bc06d..c50c8607aa0a 100644 --- a/sys/sys/jail.h +++ b/sys/sys/jail.h @@ -253,7 +253,8 @@ struct prison_racct { #define PR_ALLOW_SUSER 0x00000400 #define PR_ALLOW_RESERVED_PORTS 0x00008000 #define PR_ALLOW_KMEM_ACCESS 0x00010000 /* reserved, not used yet */ -#define PR_ALLOW_ALL_STATIC 0x000187ff +#define PR_ALLOW_NFSD 0x00020000 +#define PR_ALLOW_ALL_STATIC 0x000387ff /* * PR_ALLOW_DIFFERENCES determines which flags are able to be @@ -420,6 +421,7 @@ void getjailname(struct ucred *cred, char *name, size_t len); void prison0_init(void); int prison_allow(struct ucred *, unsigned); int prison_check(struct ucred *cred1, struct ucred *cred2); +bool prison_check_nfsd(struct ucred *cred); int prison_owns_vnet(struct ucred *); int prison_canseemount(struct ucred *cred, struct mount *mp); void prison_enforce_statfs(struct ucred *cred, struct mount *mp,