summaryrefslogtreecommitdiffstats
path: root/usr.sbin
diff options
context:
space:
mode:
authorpjd <pjd@FreeBSD.org>2007-04-05 21:03:05 +0000
committerpjd <pjd@FreeBSD.org>2007-04-05 21:03:05 +0000
commit7e73da14eb8410d6878c1e60cdb665d8a8c74c47 (patch)
tree608077732ab03acb392e93cd02387b0b39403bf6 /usr.sbin
parenta4513e9da8410de9807fcc5d2c2387629787ca6d (diff)
downloadFreeBSD-src-7e73da14eb8410d6878c1e60cdb665d8a8c74c47.zip
FreeBSD-src-7e73da14eb8410d6878c1e60cdb665d8a8c74c47.tar.gz
Add security.jail.mount_allowed sysctl, which allows to mount and
unmount jail-friendly file systems from within a jail. Precisely it grants PRIV_VFS_MOUNT, PRIV_VFS_UNMOUNT and PRIV_VFS_MOUNT_NONUSER privileges for a jailed super-user. It is turned off by default. A jail-friendly file system is a file system which driver registers itself with VFCF_JAIL flag via VFS_SET(9) API. The lsvfs(1) command can be used to see which file systems are jail-friendly ones. There currently no jail-friendly file systems, ZFS will be the first one. In the future we may consider marking file systems like nullfs as jail-friendly. Reviewed by: rwatson
Diffstat (limited to 'usr.sbin')
-rw-r--r--usr.sbin/jail/jail.810
1 files changed, 10 insertions, 0 deletions
diff --git a/usr.sbin/jail/jail.8 b/usr.sbin/jail/jail.8
index 7fd974c..e9b77e4 100644
--- a/usr.sbin/jail/jail.8
+++ b/usr.sbin/jail/jail.8
@@ -546,6 +546,15 @@ or clear system file flags; if non-zero, such users are treated as
privileged, and may manipulate system file flags subject to the usual
constraints on
.Va kern.securelevel .
+.It Va security.jail.mount_allowed
+This MIB entry determines if a privileged user inside a jail will be
+able to mount and unmount file system types marked as jail-friendly.
+The
+.Xr lsvfs 1
+command can be used to find file system types available for mount from within
+a jail.
+This functionality is disabled by default, but can be enabled by setting this
+MIB entry to 1.
.El
.Pp
The read-only sysctl variable
@@ -572,6 +581,7 @@ and
.Va kern.hostname .
.Sh SEE ALSO
.Xr killall 1 ,
+.Xr lsvfs 1 ,
.Xr newaliases 1 ,
.Xr pgrep 1 ,
.Xr pkill 1 ,
OpenPOWER on IntegriCloud