Date: Fri, 23 Aug 2013 09:11:02 +1000 From: "Dewayne Geraghty" <dewayne.geraghty@heuristicsystems.com.au> To: <d@delphij.net>, <freebsd-security@freebsd.org> Cc: freebsd-fs@freebsd.org Subject: RE: Allowing tmpfs to be mounted in jail? Message-ID: <641D3DB0C34A482EA7F5902243F3F6D0@white> In-Reply-To: <52166351.4030106@delphij.net> References: <52166351.4030106@delphij.net>
next in thread | previous in thread | raw e-mail | index | archive | help
> -----Original Message-----
> From: owner-freebsd-security@freebsd.org
> [mailto:owner-freebsd-security@freebsd.org] On Behalf Of Xin Li
> Sent: Friday, 23 August 2013 5:15 AM
> To: freebsd-security@freebsd.org
> Cc: freebsd-fs@freebsd.org; kib@freebsd.org
> Subject: Allowing tmpfs to be mounted in jail?
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> Hi,
>
> Do anybody have concerns if I would commit this?
>
> Index: sys/fs/tmpfs/tmpfs_vfsops.c
> ===================================================================
> - --- sys/fs/tmpfs/tmpfs_vfsops.c (revision 254663)
> +++ sys/fs/tmpfs/tmpfs_vfsops.c (working copy)
> @@ -420,4 +420,4 @@ struct vfsops tmpfs_vfsops = {
> .vfs_statfs = tmpfs_statfs,
> .vfs_fhtovp = tmpfs_fhtovp,
> };
> - -VFS_SET(tmpfs_vfsops, tmpfs, 0);
> +VFS_SET(tmpfs_vfsops, tmpfs, VFCF_JAIL);
>
> Cheers,
> - --
> Xin LI <delphij@delphij.net> https://www.delphij.net/
> FreeBSD - The Power to Serve! Live free or die
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.21 (FreeBSD)
>
> iQEcBAEBCgAGBQJSFmNRAAoJEG80Jeu8UPuzhFMH/2jligxAHwhYCbaYe43d8XXd
> 8ljxmusiVWLTwsjhcZRs0Pg56BSPFR2yMbf1rLgQQCc1HpIK82N9zd3hfDoSZTM3
> fhY+gB+M3aMfQ3A0lGzpCckFdj7Dlyr+drXuVeKsTCEdM7U82/GRBq/wkI8OGft4
> kCd9kmpiupFL5WmboBJNjC1wSgn0TYeGXazkTY9K4n0HmZP+306xf6ABHEkPO5XI
> nJuGsq8u2MhBmet4Cm38dGJGXym5mWRkU/i+YmgDTCVWbdKwILtEHQyq55krSPkP
> p85ntduffcAwcy8Yl8facveYq+pybQKO9pEP8hUMZIN0bLPCM01FQl5x4vbyFzc=
> =w8tX
> -----END PGP SIGNATURE-----
> _______________________________________________
> freebsd-security@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-security
> To unsubscribe, send any mail to
> "freebsd-security-unsubscribe@freebsd.org"
Xin Li,
I can envision the use of tmpfs without providing access to mounting other devices within a jail context.
It would be better if this feature had its own sysctl to control the jail's state, particularly as a DOS could "inadvertently" be
introduced, per Kib's earlier point. Other devices-types have additional mitigation strategies, such as exclusion via dev.rules
which tmpfs doesn't have.
Regards, Dewayne.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?641D3DB0C34A482EA7F5902243F3F6D0>