Date: Tue, 23 Jul 2013 23:44:49 +0000 From: "Teske, Devin" <Devin.Teske@fisglobal.com> To: Mateusz Guzik <mjguzik@gmail.com> Cc: Devin Teske <dteske@freebsd.org>, Yuri <yuri@rawbw.com>, FreeBSD Hackers <hackers@freebsd.org> Subject: Re: Should process run under chroot(8) still see mounts on the original system? Message-ID: <13CA24D6AB415D428143D44749F57D7201FD74F9@ltcfiswmsgmb21> In-Reply-To: <20130723233102.GA19249@dft-labs.eu> References: <51EF0EEE.8030000@rawbw.com> <20130723233102.GA19249@dft-labs.eu>
next in thread | previous in thread | raw e-mail | index | archive | help
On Jul 23, 2013, at 4:31 PM, Mateusz Guzik wrote: > On Tue, Jul 23, 2013 at 04:17:02PM -0700, Yuri wrote: >> Currently, mount directories as shown by mount(8) command and >> /compat/linux/dev/mounts from linprocfs(5) still show the original >> mount points as other non-chrooted processes see. >> So, when some program run under chroot tries to read the mount >> points and do something with them it would likely fail because those >> paths aren't what the process actually sees in its file system. >>=20 >> There are two situations: one when the process was started already >> chrooted (like with command chroot(8)), and another one is when >> process calls chroot(2) itself. Currently system seems to not >> differentiate between these two cases. >>=20 >> It looks reasonable to automatically modify mount(8) and >> linprocfs(5) results when the process has been started already >> chrooted and this process is (practically) always unaware of chroot. >> So that when chroot was in place when execve(2), kernel could set >> the boolean flag and later adjust mount directories accordingly. >>=20 >=20 > While changing the code to do what you propose would not be that > difficult, I don't see the point. In cases like this you can simply > jail(2) and there you go (or at least this should work just fine). >=20 > Of course then you may have some unnecessary separation but that I > believe can be simply worked out if it turns out to be problematic. >=20 What the OP wants is implemented for jails via the sysctl ``knob'' "securit= y.jail.enforce_statfs" It can have one of three values. 0 =3D show nothing from the base in jailed df(1) output 2 =3D show everything from the base in jailed df(1) output What you want sounds like the number in-between: 1 =3D show only mount points from the base that appear within the jail *and= * make the jailed df(1) output show a modified path that is rooted in said = jail --=20 Devin _____________ The information contained in this message is proprietary and/or confidentia= l. If you are not the intended recipient, please: (i) delete the message an= d all copies; (ii) do not disclose, distribute or use the message in any ma= nner; and (iii) notify the sender immediately. In addition, please be aware= that any message addressed to our domain is subject to archiving and revie= w by persons other than the intended recipient. Thank you.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?13CA24D6AB415D428143D44749F57D7201FD74F9>