diff options
| author | jamie <jamie@FreeBSD.org> | 2009-07-31 16:00:41 +0000 |
|---|---|---|
| committer | jamie <jamie@FreeBSD.org> | 2009-07-31 16:00:41 +0000 |
| commit | e87d51a605f8bb310fe758ee313a059595ceddfe (patch) | |
| tree | aef229a81886632c21374de07f52c561cbdbc5da | |
| parent | f3a133a1c3e51313adf8d92e5bd438b70a684ae6 (diff) | |
| download | FreeBSD-src-e87d51a605f8bb310fe758ee313a059595ceddfe.zip FreeBSD-src-e87d51a605f8bb310fe758ee313a059595ceddfe.tar.gz | |
Make the "enforce_statfs" default 2 (most restrictive) in jail_set(2),
instead of whatever the parent/system has (which is generally 0). This
mirrors the old-style default used for jail(2) in conjunction with the
security.jail.enforce_statfs sysctl.
Approved by: re (kib), bz (mentor)
| -rw-r--r-- | sys/kern/kern_jail.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/sys/kern/kern_jail.c b/sys/kern/kern_jail.c index 45f864a..03612d7 100644 --- a/sys/kern/kern_jail.c +++ b/sys/kern/kern_jail.c @@ -165,9 +165,10 @@ static char *pr_allow_nonames[] = { "allow.nosocket_af", }; -#define JAIL_DEFAULT_ALLOW PR_ALLOW_SET_HOSTNAME +#define JAIL_DEFAULT_ALLOW PR_ALLOW_SET_HOSTNAME +#define JAIL_DEFAULT_ENFORCE_STATFS 2 static unsigned jail_default_allow = JAIL_DEFAULT_ALLOW; -static int jail_default_enforce_statfs = 2; +static int jail_default_enforce_statfs = JAIL_DEFAULT_ENFORCE_STATFS; #if defined(INET) || defined(INET6) static unsigned jail_max_af_ips = 255; #endif @@ -1181,7 +1182,7 @@ kern_jail_set(struct thread *td, struct uio *optuio, int flags) #endif pr->pr_securelevel = ppr->pr_securelevel; pr->pr_allow = JAIL_DEFAULT_ALLOW & ppr->pr_allow; - pr->pr_enforce_statfs = ppr->pr_enforce_statfs; + pr->pr_enforce_statfs = JAIL_DEFAULT_ENFORCE_STATFS; LIST_INIT(&pr->pr_children); mtx_init(&pr->pr_mtx, "jail mutex", NULL, MTX_DEF | MTX_DUPOK); |
