kgess-mirror/freebsd-src
1
0
Fork 0
mirror of https://git.freebsd.org/src.git synced 2026-01-12 06:54:03 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

vfs: Let prison_enforce_statfs zero the fsid

Browse source 
Currently, we unconditionally zero the fsid before returning a struct
statfs to a jailed process.  Move this into prison_enforce_statfs() so
it only happens if enforce_statfs is greater than 1, or enforce_statfs
is 1 but the mountpoint is outside the jail.

PR:		291301
MFC after:	1 week
Reviewed by:	kib
Differential Revision:	https://reviews.freebsd.org/D54214
This commit is contained in:
Dag-Erling Smørgrav 2025-12-14 14:16:16 +01:00
parent 1dee2336ab
commit d4f25d0c79
2 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
sys/kern/kern_jail.c
View file

@ -4117,11 +4117,14 @@ prison_enforce_statfs(struct ucred *cred, struct mount *mp, struct statfs *sp)
if (pr->pr_enforce_statfs == 0)
return;
if (prison_canseemount(cred, mp) != 0) {
bzero(&sp->f_fsid, sizeof(sp->f_fsid));
bzero(sp->f_mntonname, sizeof(sp->f_mntonname));
strlcpy(sp->f_mntonname, "[restricted]",
sizeof(sp->f_mntonname));
return;
}
if (pr->pr_enforce_statfs > 1)
bzero(&sp->f_fsid, sizeof(sp->f_fsid));
if (pr->pr_root->v_mount == mp) {
/*
* Clear current buffer data, so we are sure nothing from

5
sys/kern/vfs_syscalls.c
View file

@ -290,10 +290,8 @@ kern_do_statfs(struct thread *td, struct mount *mp, struct statfs *buf)
error = VFS_STATFS(mp, buf);
if (error != 0)
goto out;
if (priv_check_cred_vfs_generation(td->td_ucred)) {
buf->f_fsid.val[0] = buf->f_fsid.val[1] = 0;
if (priv_check_cred_vfs_generation(td->td_ucred))
prison_enforce_statfs(td->td_ucred, mp, buf);
}
out:
vfs_unbusy(mp);
return (error);
@ -545,7 +543,6 @@ restart:
sptmp = malloc(sizeof(struct statfs), M_STATFS,
M_WAITOK);
*sptmp = *sp;
sptmp->f_fsid.val[0] = sptmp->f_fsid.val[1] = 0;
prison_enforce_statfs(td->td_ucred, mp, sptmp);
sp = sptmp;
} else