There's a curious asymmetry here: enforce_statfs==1 is checked for munging the name on unmounting, but not on mounting. I see the point on the unmount side, as statfs would give the full un-jailed pathname and an admin would naturally want to unmount what he sees mounted, but without the same logic on the mount side, it would mean the unmount path is different from the mount path which would make fstab not use for mounting inside a jail. But then, enforce_statfs==0 is a strange world to be in anyway.
I'm not sure about enforce_statfs!=2 in the privilege check. It seems a reasonable response to a contradictory set of permissions, but then so does the strange case if being able to mount a filesystem and then not being able to see it in statfs. - Jamie On 07/28/11 08:59, Martin Matuska wrote:
Please review my attached patch. The patch fixes f_mntonname with mount/unmount inside a jail with allow.mount enabled. Filesystems mountable in a jail require the VFCF_JAIL flag (currently only ZFS). With this patch, mount and unmount works both with enforce_statfs = 0 and enforce_statfs = 1. I suggest disabling mount/unmount for jails with enforce_statfs = 2, as this is contradictory and does not play well with or without this patch. I have successfully tested this patch with ZFS, nullfs and tmpfs. To enable nullfs for a jail, you have to modify tmpfs/tmpfs_vfsops.c and recompile the tmpfs module: -VFS_SET(tmpfs_vfsops, tmpfs, 0); +VFS_SET(tmpfs_vfsops, tmpfs, VFCF_JAIL); To enable tmpfs for a jail, you have to modify nullfs/null_vfsops.c and recompile the nullfs module: -VFS_SET(null_vfsops, nullfs, VFCF_LOOPBACK); +VFS_SET(null_vfsops, nullfs, VFCF_LOOPBACK | VFCF_JAIL); The filesystems can be successfully mounted/unmounted inside a jail and also unmounted from the parent host without problems. The mount inside jail, a jail needs allow.mount=1 and enforce.statfs=0 or enforce.statfs=1, for more information see jail(8) I assume other filesystem not dealing with devices may work correctly with this patch, too (e.g. nfs). With jailed nullfs we can run tinderbox in a jail ;) Please review, comment and/or test my attached patch. Cheers, mm
_______________________________________________ freebsd-current@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-current To unsubscribe, send any mail to "freebsd-current-unsubscr...@freebsd.org"
