Date: Sun, 5 May 2013 10:50:42 +0200 From: Baptiste Daroussin <bapt@FreeBSD.org> To: Jase Thew <jase@FreeBSD.org> Cc: jail@FreeBSD.org, fs@FreeBSD.org, Jamie Gritton <jamie@FreeBSD.org> Subject: Re: Marking some FS as jailable Message-ID: <20130505085042.GA12114@ithaqua.etoilebsd.net> In-Reply-To: <5185AF20.5010308@FreeBSD.org> References: <20130212194047.GE12760@ithaqua.etoilebsd.net> <511B1F55.3080500@FreeBSD.org> <20130214132715.GG44004@ithaqua.etoilebsd.net> <511CF77A.2080005@FreeBSD.org> <20130214145600.GI44004@ithaqua.etoilebsd.net> <511CFBAC.3000803@FreeBSD.org> <20130214150857.GK44004@ithaqua.etoilebsd.net> <5185AF20.5010308@FreeBSD.org>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --]
On Sun, May 05, 2013 at 02:00:16AM +0100, Jase Thew wrote:
> On 14/02/2013 15:08, Baptiste Daroussin wrote:
> > On Thu, Feb 14, 2013 at 07:58:52AM -0700, Jamie Gritton wrote:
> >> On 02/14/13 07:56, Baptiste Daroussin wrote:
> >>> On Thu, Feb 14, 2013 at 07:40:58AM -0700, Jamie Gritton wrote:
> >>>> On 02/14/13 06:27, Baptiste Daroussin wrote:
> >>>>> On Tue, Feb 12, 2013 at 10:06:29PM -0700, Jamie Gritton wrote:
> >>>>>> On 02/12/13 12:40, Baptiste Daroussin wrote:
> >>>>>>>
> >>>>>>> I would like to mark some filesystem as jailable, here is the one I need:
> >>>>>>> linprocfs, tmpfs and fdescfs, I was planning to do it with adding a
> >>>>>>> allow.mount.${fs} for each one.
> >>>>>>>
> >>>>>>> Anyone has an objection?
> >>>>>>
> >>>>>> Would it make sense for linprocfs to use the existing allow.mount.procfs
> >>>>>> flag?
> >>>>>
> >>>>> Here is a patch that uses allow.mount.procfs for linsysfs and linprocfs.
> >>>>>
> >>>>> It also addd a new allow.mount.tmpfs to allow tmpfs.
> >>>>>
> >>>>> It seems to work here, can anyone confirm this is the right way to do it?
> >>>>>
> >>>>> I'll commit in 2 parts: first lin*fs, second tmpfs related things
> >>>>>
> >>>>> http://people.freebsd.org/~bapt/jail-fs.diff
> >>>>
> >>>> There are some problems. The usage on the mount side of things looks
> >>>> correct, but it needs more on the jail side. I'm including a patch just
> >>>> of that part, with a correction in jail.h and further changes in kern_jail.c
> >>>
> >>> Thank you the patch has been updated with your fixes.
> >>
> >> One more bit (literally): PR_ALLOW_ALL in sys/jail.h needs updating.
> >>
> >> - Jamie
> >
> > Fixed thanks
> >
> > Bapt
> >
>
> Hi,
>
> Is this functionality likely to make its way into HEAD and if so, do you
> have any idea as to the timescale?
>
> Regards,
>
I would love to but I m still waiting for a security review noone has done yet
;(
[-- Attachment #2 --]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.19 (FreeBSD)
iEYEARECAAYFAlGGHWIACgkQ8kTtMUmk6Ez1ZACeJ5Uwa0vIA4iVc2u9SOWWzDN0
d4sAnA82Ma/SF2OK+OXJQZO6XzxdL7tZ
=0ajI
-----END PGP SIGNATURE-----
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20130505085042.GA12114>