diff options
| author | mm <mm@FreeBSD.org> | 2012-02-23 18:51:24 +0000 |
|---|---|---|
| committer | mm <mm@FreeBSD.org> | 2012-02-23 18:51:24 +0000 |
| commit | 4825085ea4c115cda3f658f509ee7eac649d4267 (patch) | |
| tree | 9a2a88cb10722db25dcb45d3c1ae2c34dec88614 /sys/fs/nullfs | |
| parent | da3a5506b851a2db73c9386b1ec92a3eb991e0fd (diff) | |
| download | FreeBSD-src-4825085ea4c115cda3f658f509ee7eac649d4267.zip FreeBSD-src-4825085ea4c115cda3f658f509ee7eac649d4267.tar.gz | |
To improve control over the use of mount(8) inside a jail(8), introduce
a new jail parameter node with the following parameters:
allow.mount.devfs:
allow mounting the devfs filesystem inside a jail
allow.mount.nullfs:
allow mounting the nullfs filesystem inside a jail
Both parameters are disabled by default (equals the behavior before
devfs and nullfs in jails). Administrators have to explicitly allow
mounting devfs and nullfs for each jail. The value "-1" of the
devfs_ruleset parameter is removed in favor of the new allow setting.
Reviewed by: jamie
Suggested by: pjd
MFC after: 2 weeks
Diffstat (limited to 'sys/fs/nullfs')
| -rw-r--r-- | sys/fs/nullfs/null_vfsops.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/sys/fs/nullfs/null_vfsops.c b/sys/fs/nullfs/null_vfsops.c index 97874b3..b422077 100644 --- a/sys/fs/nullfs/null_vfsops.c +++ b/sys/fs/nullfs/null_vfsops.c @@ -50,6 +50,7 @@ #include <sys/namei.h> #include <sys/proc.h> #include <sys/vnode.h> +#include <sys/jail.h> #include <fs/nullfs/null.h> @@ -75,12 +76,16 @@ nullfs_mount(struct mount *mp) struct vnode *lowerrootvp, *vp; struct vnode *nullm_rootvp; struct null_mount *xmp; + struct thread *td = curthread; char *target; int isvnunlocked = 0, len; struct nameidata nd, *ndp = &nd; NULLFSDEBUG("nullfs_mount(mp = %p)\n", (void *)mp); + if (!prison_allow(td->td_ucred, PR_ALLOW_MOUNT_NULLFS)) + return (EPERM); + if (mp->mnt_flag & MNT_ROOTFS) return (EOPNOTSUPP); /* |
