git: 748a4ea1caff - main - jail: Make prison_owns_vnet() operate on a prison instead of a ucred

[Mark Johnston]

The branch main has been updated by markj:

URL: 
https://cgit.FreeBSD.org/src/commit/?id=748a4ea1caffca48c4949d5a7b964853c44fbdae

commit 748a4ea1caffca48c4949d5a7b964853c44fbdae
Author:     Mark Johnston <ma...@freebsd.org>
AuthorDate: 2025-07-28 15:46:26 +0000
Commit:     Mark Johnston <ma...@freebsd.org>
CommitDate: 2025-07-28 16:19:38 +0000

    jail: Make prison_owns_vnet() operate on a prison instead of a ucred
    
    This will be useful in an upcoming change.  No functional change
    intended.
    
    Reviewed by:    jamie
    MFC after:      2 weeks
    Sponsored by:   Stormshield
    Sponsored by:   Klara, Inc.
    Differential Revision:  https://reviews.freebsd.org/D51524
---
 sys/kern/kern_jail.c   | 17 +++++++----------
 sys/kern/kern_sysctl.c |  2 +-
 sys/sys/jail.h         |  2 +-
 3 files changed, 9 insertions(+), 12 deletions(-)

diff --git a/sys/kern/kern_jail.c b/sys/kern/kern_jail.c
index d4529e096929..7ef1d19f0ea8 100644
--- a/sys/kern/kern_jail.c
+++ b/sys/kern/kern_jail.c
@@ -3466,7 +3466,7 @@ prison_check_af(struct ucred *cred, int af)
        pr = cred->cr_prison;
 #ifdef VIMAGE
        /* Prisons with their own network stack are not limited. */
-       if (prison_owns_vnet(cred))
+       if (prison_owns_vnet(pr))
                return (0);
 #endif
 
@@ -3531,7 +3531,7 @@ prison_if(struct ucred *cred, const struct sockaddr *sa)
        KASSERT(sa != NULL, ("%s: sa is NULL", __func__));
 
 #ifdef VIMAGE
-       if (prison_owns_vnet(cred))
+       if (prison_owns_vnet(cred->cr_prison))
                return (0);
 #endif
 
@@ -3648,7 +3648,7 @@ jailed_without_vnet(struct ucred *cred)
        if (!jailed(cred))
                return (false);
 #ifdef VIMAGE
-       if (prison_owns_vnet(cred))
+       if (prison_owns_vnet(cred->cr_prison))
                return (false);
 #endif
 
@@ -3711,20 +3711,17 @@ getjailname(struct ucred *cred, char *name, size_t len)
 
 #ifdef VIMAGE
 /*
- * Determine whether the prison represented by cred owns
- * its vnet rather than having it inherited.
- *
- * Returns true in case the prison owns the vnet, false otherwise.
+ * Determine whether the prison owns its VNET.
  */
 bool
-prison_owns_vnet(struct ucred *cred)
+prison_owns_vnet(struct prison *pr)
 {
 
        /*
         * vnets cannot be added/removed after jail creation,
         * so no need to lock here.
         */
-       return ((cred->cr_prison->pr_flags & PR_VNET) != 0);
+       return ((pr->pr_flags & PR_VNET) != 0);
 }
 #endif
 
@@ -4425,7 +4422,7 @@ sysctl_jail_vnet(SYSCTL_HANDLER_ARGS)
 #ifdef VIMAGE
        struct ucred *cred = req->td->td_ucred;
 
-       havevnet = jailed(cred) && prison_owns_vnet(cred);
+       havevnet = jailed(cred) && prison_owns_vnet(cred->cr_prison);
 #else
        havevnet = 0;
 #endif
diff --git a/sys/kern/kern_sysctl.c b/sys/kern/kern_sysctl.c
index 46226cc31980..25da134661e9 100644
--- a/sys/kern/kern_sysctl.c
+++ b/sys/kern/kern_sysctl.c
@@ -2368,7 +2368,7 @@ sysctl_root(SYSCTL_HANDLER_ARGS)
                        priv = PRIV_SYSCTL_WRITEJAIL;
 #ifdef VIMAGE
                else if ((oid->oid_kind & CTLFLAG_VNET) &&
-                    prison_owns_vnet(req->td->td_ucred))
+                    prison_owns_vnet(req->td->td_ucred->cr_prison))
                        priv = PRIV_SYSCTL_WRITEJAIL;
 #endif
                else
diff --git a/sys/sys/jail.h b/sys/sys/jail.h
index 08caa9f49270..24c420e2c976 100644
--- a/sys/sys/jail.h
+++ b/sys/sys/jail.h
@@ -435,7 +435,7 @@ void prison0_init(void);
 bool prison_allow(struct ucred *, unsigned);
 int prison_check(struct ucred *cred1, struct ucred *cred2);
 bool prison_check_nfsd(struct ucred *cred);
-bool prison_owns_vnet(struct ucred *);
+bool prison_owns_vnet(struct prison *pr);
 int prison_canseemount(struct ucred *cred, struct mount *mp);
 void prison_enforce_statfs(struct ucred *cred, struct mount *mp,
     struct statfs *sp);