From owner-svn-src-all@FreeBSD.ORG Sat Jan 31 17:35:55 2015 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 277B07C2; Sat, 31 Jan 2015 17:35:55 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 08960771; Sat, 31 Jan 2015 17:35:55 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.9/8.14.9) with ESMTP id t0VHZsZn096177; Sat, 31 Jan 2015 17:35:54 GMT (envelope-from jamie@FreeBSD.org) Received: (from jamie@localhost) by svn.freebsd.org (8.14.9/8.14.9/Submit) id t0VHZsXb096173; Sat, 31 Jan 2015 17:35:54 GMT (envelope-from jamie@FreeBSD.org) Message-Id: <201501311735.t0VHZsXb096173@svn.freebsd.org> X-Authentication-Warning: svn.freebsd.org: jamie set sender to jamie@FreeBSD.org using -f From: Jamie Gritton Date: Sat, 31 Jan 2015 17:35:54 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org Subject: svn commit: r277985 - in stable/10: sys/fs/fdescfs sys/kern sys/sys usr.sbin/jail X-SVN-Group: stable-10 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 31 Jan 2015 17:35:55 -0000 Author: jamie Date: Sat Jan 31 17:35:53 2015 New Revision: 277985 URL: https://svnweb.freebsd.org/changeset/base/277985 Log: MFC r277855: Add allow.mount.fdescfs jail flag. PR: 192951 Submitted by: ruben@verweg.com Modified: stable/10/sys/fs/fdescfs/fdesc_vfsops.c stable/10/sys/kern/kern_jail.c stable/10/sys/sys/jail.h stable/10/usr.sbin/jail/jail.8 Directory Properties: stable/10/ (props changed) Modified: stable/10/sys/fs/fdescfs/fdesc_vfsops.c ============================================================================== --- stable/10/sys/fs/fdescfs/fdesc_vfsops.c Sat Jan 31 17:08:02 2015 (r277984) +++ stable/10/sys/fs/fdescfs/fdesc_vfsops.c Sat Jan 31 17:35:53 2015 (r277985) @@ -42,6 +42,7 @@ #include #include #include +#include #include #include #include @@ -78,8 +79,12 @@ fdesc_mount(struct mount *mp) { int error = 0; struct fdescmount *fmp; + struct thread *td = curthread; struct vnode *rvp; + if (!prison_allow(td->td_ucred, PR_ALLOW_MOUNT_FDESCFS)) + return (EPERM); + /* * Update is a no-op */ @@ -237,4 +242,4 @@ static struct vfsops fdesc_vfsops = { .vfs_unmount = fdesc_unmount, }; -VFS_SET(fdesc_vfsops, fdescfs, VFCF_SYNTHETIC); +VFS_SET(fdesc_vfsops, fdescfs, VFCF_SYNTHETIC | VFCF_JAIL); Modified: stable/10/sys/kern/kern_jail.c ============================================================================== --- stable/10/sys/kern/kern_jail.c Sat Jan 31 17:08:02 2015 (r277984) +++ stable/10/sys/kern/kern_jail.c Sat Jan 31 17:35:53 2015 (r277985) @@ -207,6 +207,7 @@ static char *pr_allow_names[] = { "allow.mount.zfs", "allow.mount.procfs", "allow.mount.tmpfs", + "allow.mount.fdescfs", }; const size_t pr_allow_names_size = sizeof(pr_allow_names); @@ -223,6 +224,7 @@ static char *pr_allow_nonames[] = { "allow.mount.nozfs", "allow.mount.noprocfs", "allow.mount.notmpfs", + "allow.mount.nofdescfs", }; const size_t pr_allow_nonames_size = sizeof(pr_allow_nonames); @@ -4231,6 +4233,10 @@ SYSCTL_PROC(_security_jail, OID_AUTO, mo CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, NULL, PR_ALLOW_MOUNT_DEVFS, sysctl_jail_default_allow, "I", "Processes in jail can mount the devfs file system"); +SYSCTL_PROC(_security_jail, OID_AUTO, mount_fdescfs_allowed, + CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, + NULL, PR_ALLOW_MOUNT_FDESCFS, sysctl_jail_default_allow, "I", + "Processes in jail can mount the fdescfs file system"); SYSCTL_PROC(_security_jail, OID_AUTO, mount_nullfs_allowed, CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, NULL, PR_ALLOW_MOUNT_NULLFS, sysctl_jail_default_allow, "I", @@ -4391,6 +4397,8 @@ SYSCTL_JAIL_PARAM(_allow_mount, , CTLTYP "B", "Jail may mount/unmount jail-friendly file systems in general"); SYSCTL_JAIL_PARAM(_allow_mount, devfs, CTLTYPE_INT | CTLFLAG_RW, "B", "Jail may mount the devfs file system"); +SYSCTL_JAIL_PARAM(_allow_mount, fdescfs, CTLTYPE_INT | CTLFLAG_RW, + "B", "Jail may mount the fdescfs file system"); SYSCTL_JAIL_PARAM(_allow_mount, nullfs, CTLTYPE_INT | CTLFLAG_RW, "B", "Jail may mount the nullfs file system"); SYSCTL_JAIL_PARAM(_allow_mount, procfs, CTLTYPE_INT | CTLFLAG_RW, Modified: stable/10/sys/sys/jail.h ============================================================================== --- stable/10/sys/sys/jail.h Sat Jan 31 17:08:02 2015 (r277984) +++ stable/10/sys/sys/jail.h Sat Jan 31 17:35:53 2015 (r277985) @@ -228,7 +228,8 @@ struct prison_racct { #define PR_ALLOW_MOUNT_ZFS 0x0200 #define PR_ALLOW_MOUNT_PROCFS 0x0400 #define PR_ALLOW_MOUNT_TMPFS 0x0800 -#define PR_ALLOW_ALL 0x0fff +#define PR_ALLOW_MOUNT_FDESCFS 0x1000 +#define PR_ALLOW_ALL 0x1fff /* * OSD methods Modified: stable/10/usr.sbin/jail/jail.8 ============================================================================== --- stable/10/usr.sbin/jail/jail.8 Sat Jan 31 17:08:02 2015 (r277984) +++ stable/10/usr.sbin/jail/jail.8 Sat Jan 31 17:35:53 2015 (r277985) @@ -25,7 +25,7 @@ .\" .\" $FreeBSD$ .\" -.Dd August 4, 2014 +.Dd January 28, 2015 .Dt JAIL 8 .Os .Sh NAME @@ -362,7 +362,7 @@ A set of IPv6 options for the jail, the and .Va ip4 above. -.It vnet +.It Va vnet Create the jail with its own virtual network stack, with its own network interfaces, addresses, routing table, etc. The kernel must have been compiled with the @@ -531,6 +531,14 @@ is set to a value lower than 2. The devfs ruleset should be restricted from the default by using the .Va devfs_ruleset option. +.It Va allow.mount.fdescfs +privileged users inside the jail will be able to mount and unmount the +fdescfs file system. +This permission is effective only together with +.Va allow.mount +and only when +.Va enforce_statfs +is set to a value lower than 2. .It Va allow.mount.nullfs privileged users inside the jail will be able to mount and unmount the nullfs file system.