diff --git a/sys/contrib/openzfs/include/os/freebsd/spl/sys/vfs.h.zfssnap b/sys/contrib/openzfs/include/os/freebsd/spl/sys/vfs.h --- a/sys/contrib/openzfs/include/os/freebsd/spl/sys/vfs.h.zfssnap +++ b/sys/contrib/openzfs/include/os/freebsd/spl/sys/vfs.h @@ -101,7 +101,7 @@ void vfs_clearmntopt(vfs_t *vfsp, const char *name); int vfs_optionisset(const vfs_t *vfsp, const char *opt, char **argp); int mount_snapshot(kthread_t *td, vnode_t **vpp, const char *fstype, - char *fspath, char *fspec, int fsflags); + char *fspath, char *fspec, int fsflags, vfs_t *vfsp); typedef uint64_t vfs_feature_t; diff --git a/sys/contrib/openzfs/module/os/freebsd/spl/spl_vfs.c.zfssnap b/sys/contrib/openzfs/module/os/freebsd/spl/spl_vfs.c --- a/sys/contrib/openzfs/module/os/freebsd/spl/spl_vfs.c.zfssnap +++ b/sys/contrib/openzfs/module/os/freebsd/spl/spl_vfs.c @@ -120,7 +120,7 @@ int mount_snapshot(kthread_t *td, vnode_t **vpp, const char *fstype, char *fspath, - char *fspec, int fsflags) + char *fspec, int fsflags, vfs_t *parent_vfsp) { struct vfsconf *vfsp; struct mount *mp; @@ -219,6 +219,11 @@ vfs_freeopts(mp->mnt_opt); mp->mnt_opt = mp->mnt_optnew; (void) VFS_STATFS(mp, &mp->mnt_stat); + + /* + * Clone the mnt_exjail credentials of the parent, as required. + */ + vfs_exjail_clone(parent_vfsp, mp); /* * Prevent external consumers of mount options from reading diff --git a/sys/contrib/openzfs/module/os/freebsd/zfs/zfs_ctldir.c.zfssnap b/sys/contrib/openzfs/module/os/freebsd/zfs/zfs_ctldir.c --- a/sys/contrib/openzfs/module/os/freebsd/zfs/zfs_ctldir.c.zfssnap +++ b/sys/contrib/openzfs/module/os/freebsd/zfs/zfs_ctldir.c @@ -1026,7 +1026,8 @@ "%s/" ZFS_CTLDIR_NAME "/snapshot/%s", dvp->v_vfsp->mnt_stat.f_mntonname, name); - err = mount_snapshot(curthread, vpp, "zfs", mountpoint, fullname, 0); + err = mount_snapshot(curthread, vpp, "zfs", mountpoint, fullname, 0, + dvp->v_vfsp); kmem_free(mountpoint, mountpoint_len); if (err == 0) { /* diff --git a/sys/kern/vfs_mount.c.zfssnap b/sys/kern/vfs_mount.c --- a/sys/kern/vfs_mount.c.zfssnap +++ b/sys/kern/vfs_mount.c @@ -3141,3 +3141,29 @@ } mtx_unlock(&mountlist_mtx); } + +/* + * Clone the mnt_exjail field to a new mount point. + */ +void +vfs_exjail_clone(struct mount *inmp, struct mount *outmp) +{ + struct ucred *cr; + + MNT_ILOCK(inmp); + cr = inmp->mnt_exjail; + if (cr != NULL) { + crhold(cr); + MNT_IUNLOCK(inmp); + MNT_ILOCK(outmp); + if (outmp->mnt_exjail == NULL) { + outmp->mnt_exjail = cr; + atomic_add_int(&cr->cr_prison->pr_exportcnt, 1); + cr = NULL; + } + MNT_IUNLOCK(outmp); + if (cr != NULL) + crfree(cr); + } else + MNT_IUNLOCK(inmp); +} diff --git a/sys/sys/mount.h.zfssnap b/sys/sys/mount.h --- a/sys/sys/mount.h.zfssnap +++ b/sys/sys/mount.h @@ -1017,6 +1017,7 @@ (struct mount *, struct netexport *, struct export_args *); void vfs_periodic(struct mount *, int); int vfs_busy(struct mount *, int); +void vfs_exjail_clone(struct mount *, struct mount *); void vfs_exjail_delete(struct prison *); int vfs_export /* process mount export info */ (struct mount *, struct export_args *, bool);