Author: jamie
Date: Fri Jul 31 16:00:41 2009
New Revision: 196002
URL: http://svn.freebsd.org/changeset/base/196002
Log:
Make the "enforce_statfs" default 2 (most restrictive) in jail_set(2),
instead of whatever the parent/system has (which is generally 0). This
mirrors the old-style default used for jail(2) in conjunction with the
security.jail.enforce_statfs sysctl.
Approved by: re (kib), bz (mentor)
Modified:
head/sys/kern/kern_jail.c
Modified: head/sys/kern/kern_jail.c
==============================================================================
--- head/sys/kern/kern_jail.c Fri Jul 31 15:27:14 2009 (r196001)
+++ head/sys/kern/kern_jail.c Fri Jul 31 16:00:41 2009 (r196002)
@@ -165,9 +165,10 @@ static char *pr_allow_nonames[] = {
"allow.nosocket_af",
};
-#define JAIL_DEFAULT_ALLOW PR_ALLOW_SET_HOSTNAME
+#define JAIL_DEFAULT_ALLOW PR_ALLOW_SET_HOSTNAME
+#define JAIL_DEFAULT_ENFORCE_STATFS 2
static unsigned jail_default_allow = JAIL_DEFAULT_ALLOW;
-static int jail_default_enforce_statfs = 2;
+static int jail_default_enforce_statfs = JAIL_DEFAULT_ENFORCE_STATFS;
#if defined(INET) || defined(INET6)
static unsigned jail_max_af_ips = 255;
#endif
@@ -1181,7 +1182,7 @@ kern_jail_set(struct thread *td, struct
#endif
pr->pr_securelevel = ppr->pr_securelevel;
pr->pr_allow = JAIL_DEFAULT_ALLOW & ppr->pr_allow;
- pr->pr_enforce_statfs = ppr->pr_enforce_statfs;
+ pr->pr_enforce_statfs = JAIL_DEFAULT_ENFORCE_STATFS;
LIST_INIT(&pr->pr_children);
mtx_init(&pr->pr_mtx, "jail mutex", NULL, MTX_DEF | MTX_DUPOK);
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
