diff options
| author | pjd <pjd@FreeBSD.org> | 2007-04-05 21:03:05 +0000 |
|---|---|---|
| committer | pjd <pjd@FreeBSD.org> | 2007-04-05 21:03:05 +0000 |
| commit | 7e73da14eb8410d6878c1e60cdb665d8a8c74c47 (patch) | |
| tree | 608077732ab03acb392e93cd02387b0b39403bf6 /lib/libc | |
| parent | a4513e9da8410de9807fcc5d2c2387629787ca6d (diff) | |
| download | FreeBSD-src-7e73da14eb8410d6878c1e60cdb665d8a8c74c47.zip FreeBSD-src-7e73da14eb8410d6878c1e60cdb665d8a8c74c47.tar.gz | |
Add security.jail.mount_allowed sysctl, which allows to mount and
unmount jail-friendly file systems from within a jail.
Precisely it grants PRIV_VFS_MOUNT, PRIV_VFS_UNMOUNT and
PRIV_VFS_MOUNT_NONUSER privileges for a jailed super-user.
It is turned off by default.
A jail-friendly file system is a file system which driver registers
itself with VFCF_JAIL flag via VFS_SET(9) API.
The lsvfs(1) command can be used to see which file systems are
jail-friendly ones.
There currently no jail-friendly file systems, ZFS will be the first one.
In the future we may consider marking file systems like nullfs as
jail-friendly.
Reviewed by: rwatson
Diffstat (limited to 'lib/libc')
| -rw-r--r-- | lib/libc/gen/getvfsbyname.3 | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/lib/libc/gen/getvfsbyname.3 b/lib/libc/gen/getvfsbyname.3 index 0860c4e..2c2c97d 100644 --- a/lib/libc/gen/getvfsbyname.3 +++ b/lib/libc/gen/getvfsbyname.3 @@ -81,6 +81,11 @@ data does not represent real files aliases some other mounted FS .It Dv VFCF_UNICODE stores file names as Unicode +.It Dv VFCF_JAIL +can be mounted from within a jail if +.Va security.jail.mount_allowed +sysctl is set to +.Dv 1 . .El .Sh RETURN VALUES .Rv -std getvfsbyname @@ -99,8 +104,10 @@ argument specifies a file system that is unknown or not configured in the kernel. .El .Sh SEE ALSO +.Xr jail 2 , .Xr mount 2 , .Xr sysctl 3 , +.Xr jail 8 , .Xr mount 8 , .Xr sysctl 8 .Sh HISTORY |
