From owner-freebsd-jail@freebsd.org Tue Mar 13 16:14:34 2018 Return-Path: Delivered-To: freebsd-jail@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 01C8BF2CB17 for ; Tue, 13 Mar 2018 16:14:34 +0000 (UTC) (envelope-from jamie@freebsd.org) Received: from gritton.org (gritton.org [199.192.165.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "gritton.org", Issuer "Let's Encrypt Authority X3" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 8B10F857BB for ; Tue, 13 Mar 2018 16:14:33 +0000 (UTC) (envelope-from jamie@freebsd.org) Received: from gritton.org (gritton.org [199.192.165.131]) by gritton.org (8.15.2/8.15.2) with ESMTP id w2DGEVhc054726 for ; Tue, 13 Mar 2018 10:14:31 -0600 (MDT) (envelope-from jamie@freebsd.org) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Content-Transfer-Encoding: 7bit Date: Tue, 13 Mar 2018 10:14:31 -0600 From: James Gritton To: freebsd-jail@freebsd.org Subject: Making it easier to make filesystems jail-mountable Message-ID: <8a06c7813c1f72d8336901c5ac6dd639@freebsd.org> X-Sender: jamie@freebsd.org User-Agent: Roundcube Webmail/1.3.3 X-BeenThere: freebsd-jail@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: "Discussion about FreeBSD jail\(8\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Mar 2018 16:14:34 -0000 I've added a patch at https://reviews.freebsd.org/D14681 for anyone who wants to take a look. While it doesn't (or at least shouldn't) change any current functionality, the point is to better automate the process of making a filesystem jail-aware. Currently, this involves code changes in a few different places, mostly in expanding the list of allow.mount.* parameters. With this change, that list still contains all such filesystems, but only if they're actually present in the kernel (including when KLDs are loaded). The per-filesystem coding work is reduced to adding the VFCF_JAIL flag to the FS definition, and everything else is taken care of by the jail/vfs subsystems. This originally came from a request to make NFS work with jails, which turns out to be a much bigger and unrelated thing, but still pointed me here. - Jamie