diff options
| author | delphij <delphij@FreeBSD.org> | 2013-08-23 22:52:20 +0000 |
|---|---|---|
| committer | delphij <delphij@FreeBSD.org> | 2013-08-23 22:52:20 +0000 |
| commit | b93cf732047c8ac0128b11fd4cc88d223c23f0b7 (patch) | |
| tree | 797aa361030bae714654b6e39d8760ffacce6efb /sys | |
| parent | cf73bc83b843229737a78ef19ec7f10c25ac83bf (diff) | |
| download | FreeBSD-src-b93cf732047c8ac0128b11fd4cc88d223c23f0b7.zip FreeBSD-src-b93cf732047c8ac0128b11fd4cc88d223c23f0b7.tar.gz | |
Allow tmpfs be mounted inside jail.
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/fs/tmpfs/tmpfs_vfsops.c | 8 | ||||
| -rw-r--r-- | sys/kern/kern_jail.c | 8 | ||||
| -rw-r--r-- | sys/sys/jail.h | 3 |
3 files changed, 17 insertions, 2 deletions
diff --git a/sys/fs/tmpfs/tmpfs_vfsops.c b/sys/fs/tmpfs/tmpfs_vfsops.c index 4d55f51..57b9902 100644 --- a/sys/fs/tmpfs/tmpfs_vfsops.c +++ b/sys/fs/tmpfs/tmpfs_vfsops.c @@ -47,6 +47,8 @@ __FBSDID("$FreeBSD$"); #include <sys/limits.h> #include <sys/lock.h> #include <sys/mutex.h> +#include <sys/proc.h> +#include <sys/jail.h> #include <sys/kernel.h> #include <sys/stat.h> #include <sys/systm.h> @@ -138,6 +140,7 @@ tmpfs_mount(struct mount *mp) sizeof(struct tmpfs_dirent) + sizeof(struct tmpfs_node)); struct tmpfs_mount *tmp; struct tmpfs_node *root; + struct thread *td = curthread; int error; /* Size counters. */ u_quad_t pages; @@ -150,6 +153,9 @@ tmpfs_mount(struct mount *mp) struct vattr va; + if (!prison_allow(td->td_ucred, PR_ALLOW_MOUNT_TMPFS)) + return (EPERM); + if (vfs_filteropt(mp->mnt_optnew, tmpfs_opts)) return (EINVAL); @@ -420,4 +426,4 @@ struct vfsops tmpfs_vfsops = { .vfs_statfs = tmpfs_statfs, .vfs_fhtovp = tmpfs_fhtovp, }; -VFS_SET(tmpfs_vfsops, tmpfs, 0); +VFS_SET(tmpfs_vfsops, tmpfs, VFCF_JAIL); diff --git a/sys/kern/kern_jail.c b/sys/kern/kern_jail.c index d70a936..6451825 100644 --- a/sys/kern/kern_jail.c +++ b/sys/kern/kern_jail.c @@ -206,6 +206,7 @@ static char *pr_allow_names[] = { "allow.mount.nullfs", "allow.mount.zfs", "allow.mount.procfs", + "allow.mount.tmpfs", }; const size_t pr_allow_names_size = sizeof(pr_allow_names); @@ -221,6 +222,7 @@ static char *pr_allow_nonames[] = { "allow.mount.nonullfs", "allow.mount.nozfs", "allow.mount.noprocfs", + "allow.mount.notmpfs", }; const size_t pr_allow_nonames_size = sizeof(pr_allow_nonames); @@ -4228,6 +4230,10 @@ SYSCTL_PROC(_security_jail, OID_AUTO, mount_procfs_allowed, CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, NULL, PR_ALLOW_MOUNT_PROCFS, sysctl_jail_default_allow, "I", "Processes in jail can mount the procfs file system"); +SYSCTL_PROC(_security_jail, OID_AUTO, mount_tmpfs_allowed, + CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, + NULL, PR_ALLOW_MOUNT_TMPFS, sysctl_jail_default_allow, "I", + "Processes in jail can mount the tmpfs file system"); SYSCTL_PROC(_security_jail, OID_AUTO, mount_zfs_allowed, CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE, NULL, PR_ALLOW_MOUNT_ZFS, sysctl_jail_default_allow, "I", @@ -4380,6 +4386,8 @@ SYSCTL_JAIL_PARAM(_allow_mount, nullfs, CTLTYPE_INT | CTLFLAG_RW, "B", "Jail may mount the nullfs file system"); SYSCTL_JAIL_PARAM(_allow_mount, procfs, CTLTYPE_INT | CTLFLAG_RW, "B", "Jail may mount the procfs file system"); +SYSCTL_JAIL_PARAM(_allow_mount, tmpfs, CTLTYPE_INT | CTLFLAG_RW, + "B", "Jail may mount the tmpfs file system"); SYSCTL_JAIL_PARAM(_allow_mount, zfs, CTLTYPE_INT | CTLFLAG_RW, "B", "Jail may mount the zfs file system"); diff --git a/sys/sys/jail.h b/sys/sys/jail.h index a934aac..a82a499 100644 --- a/sys/sys/jail.h +++ b/sys/sys/jail.h @@ -227,7 +227,8 @@ struct prison_racct { #define PR_ALLOW_MOUNT_NULLFS 0x0100 #define PR_ALLOW_MOUNT_ZFS 0x0200 #define PR_ALLOW_MOUNT_PROCFS 0x0400 -#define PR_ALLOW_ALL 0x07ff +#define PR_ALLOW_MOUNT_TMPFS 0x0800 +#define PR_ALLOW_ALL 0x0fff /* * OSD methods |
