On Sun, May 05, 2013 at 02:00:16AM +0100, Jase Thew wrote: > On 14/02/2013 15:08, Baptiste Daroussin wrote: > > On Thu, Feb 14, 2013 at 07:58:52AM -0700, Jamie Gritton wrote: > >> On 02/14/13 07:56, Baptiste Daroussin wrote: > >>> On Thu, Feb 14, 2013 at 07:40:58AM -0700, Jamie Gritton wrote: > >>>> On 02/14/13 06:27, Baptiste Daroussin wrote: > >>>>> On Tue, Feb 12, 2013 at 10:06:29PM -0700, Jamie Gritton wrote: > >>>>>> On 02/12/13 12:40, Baptiste Daroussin wrote: > >>>>>>> > >>>>>>> I would like to mark some filesystem as jailable, here is the one I > >>>>>>> need: > >>>>>>> linprocfs, tmpfs and fdescfs, I was planning to do it with adding a > >>>>>>> allow.mount.${fs} for each one. > >>>>>>> > >>>>>>> Anyone has an objection? > >>>>>> > >>>>>> Would it make sense for linprocfs to use the existing > >>>>>> allow.mount.procfs > >>>>>> flag? > >>>>> > >>>>> Here is a patch that uses allow.mount.procfs for linsysfs and linprocfs. > >>>>> > >>>>> It also addd a new allow.mount.tmpfs to allow tmpfs. > >>>>> > >>>>> It seems to work here, can anyone confirm this is the right way to do > >>>>> it? > >>>>> > >>>>> I'll commit in 2 parts: first lin*fs, second tmpfs related things > >>>>> > >>>>> http://people.freebsd.org/~bapt/jail-fs.diff > >>>> > >>>> There are some problems. The usage on the mount side of things looks > >>>> correct, but it needs more on the jail side. I'm including a patch just > >>>> of that part, with a correction in jail.h and further changes in > >>>> kern_jail.c > >>> > >>> Thank you the patch has been updated with your fixes. > >> > >> One more bit (literally): PR_ALLOW_ALL in sys/jail.h needs updating. > >> > >> - Jamie > > > > Fixed thanks > > > > Bapt > > > > Hi, > > Is this functionality likely to make its way into HEAD and if so, do you > have any idea as to the timescale? > > Regards, > I would love to but I m still waiting for a security review noone has done yet ;(
pgpPznhV0ei6S.pgp
Description: PGP signature