Date: Fri, 31 Jul 2009 16:00:41 +0000 (UTC) From: Jamie Gritton <jamie@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r196002 - head/sys/kern Message-ID: <200907311600.n6VG0fJ0074159@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: jamie Date: Fri Jul 31 16:00:41 2009 New Revision: 196002 URL: http://svn.freebsd.org/changeset/base/196002 Log: Make the "enforce_statfs" default 2 (most restrictive) in jail_set(2), instead of whatever the parent/system has (which is generally 0). This mirrors the old-style default used for jail(2) in conjunction with the security.jail.enforce_statfs sysctl. Approved by: re (kib), bz (mentor) Modified: head/sys/kern/kern_jail.c Modified: head/sys/kern/kern_jail.c ============================================================================== --- head/sys/kern/kern_jail.c Fri Jul 31 15:27:14 2009 (r196001) +++ head/sys/kern/kern_jail.c Fri Jul 31 16:00:41 2009 (r196002) @@ -165,9 +165,10 @@ static char *pr_allow_nonames[] = { "allow.nosocket_af", }; -#define JAIL_DEFAULT_ALLOW PR_ALLOW_SET_HOSTNAME +#define JAIL_DEFAULT_ALLOW PR_ALLOW_SET_HOSTNAME +#define JAIL_DEFAULT_ENFORCE_STATFS 2 static unsigned jail_default_allow = JAIL_DEFAULT_ALLOW; -static int jail_default_enforce_statfs = 2; +static int jail_default_enforce_statfs = JAIL_DEFAULT_ENFORCE_STATFS; #if defined(INET) || defined(INET6) static unsigned jail_max_af_ips = 255; #endif @@ -1181,7 +1182,7 @@ kern_jail_set(struct thread *td, struct #endif pr->pr_securelevel = ppr->pr_securelevel; pr->pr_allow = JAIL_DEFAULT_ALLOW & ppr->pr_allow; - pr->pr_enforce_statfs = ppr->pr_enforce_statfs; + pr->pr_enforce_statfs = JAIL_DEFAULT_ENFORCE_STATFS; LIST_INIT(&pr->pr_children); mtx_init(&pr->pr_mtx, "jail mutex", NULL, MTX_DEF | MTX_DUPOK);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200907311600.n6VG0fJ0074159>