Page MenuHomeFreeBSD
Files F177568648

D56119.1794762221.diff
No OneTemporary
Actions

Authored By
Unknown
Size
1 KB
Referenced Files
None
Subscribers
None

D56119.1794762221.diff
View Options

diff --git a/sys/dev/vmm/vmm_dev.c b/sys/dev/vmm/vmm_dev.c
--- a/sys/dev/vmm/vmm_dev.c
+++ b/sys/dev/vmm/vmm_dev.c
@@ -114,7 +114,7 @@
static void vmmdev_destroy(struct vmmdev_softc *sc);
static int
-vmm_priv_check(struct ucred *ucred)
+vmm_jail_priv_check(struct ucred *ucred)
{
if (jailed(ucred) &&
(ucred->cr_prison->pr_allow & pr_allow_vmm_flag) == 0)
@@ -371,7 +371,7 @@
* A jail without vmm access shouldn't be able to access vmm device
* files at all, but check here just to be thorough.
*/
- error = vmm_priv_check(td->td_ucred);
+ error = vmm_jail_priv_check(td->td_ucred);
if (error != 0)
return (error);
@@ -940,7 +940,7 @@
char *buf;
int error, buflen;
- error = vmm_priv_check(req->td->td_ucred);
+ error = vmm_jail_priv_check(req->td->td_ucred);
if (error)
return (error);
@@ -1016,6 +1016,12 @@
"An unprivileged user must run VMs in monitor mode"));
}
+ if ((error = vmm_jail_priv_check(cred)) != 0) {
+ sx_xunlock(&vmmdev_mtx);
+ return (EXTERROR(error,
+ "VMs cannot be created in the current jail"));
+ }
+
if (!chgvmmcnt(cred->cr_ruidinfo, 1, vm_maxvmms)) {
sx_xunlock(&vmmdev_mtx);
return (ENOMEM);
@@ -1061,7 +1067,7 @@
if (!vmm_initialized)
return (ENXIO);
- error = vmm_priv_check(req->td->td_ucred);
+ error = vmm_jail_priv_check(req->td->td_ucred);
if (error != 0)
return (error);
@@ -1126,7 +1132,7 @@
int error;
struct vmmctl_priv *priv;
- error = vmm_priv_check(td->td_ucred);
+ error = vmm_jail_priv_check(td->td_ucred);
if (error != 0)
return (error);
diff --git a/sys/kern/kern_jail.c b/sys/kern/kern_jail.c
--- a/sys/kern/kern_jail.c
+++ b/sys/kern/kern_jail.c
@@ -4736,6 +4736,14 @@
else
return (EPERM);
+ case PRIV_VMM_CREATE:
+ case PRIV_VMM_DESTROY:
+ /*
+ * Jailed root can create and destroy VMs; the vmm module
+ * additionally checks for the allow.vmm flag.
+ */
+ return (0);
+
case PRIV_VMM_PPTDEV:
/*
* Allow jailed root to manage passthrough devices. vmm(4) also

File Metadata

Mime Type
text/plain
Expires
Sun, Nov 15, 5:03 PM (19 h, 39 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
41745660
Default Alt Text
D56119.1794762221.diff (1 KB)

Event Timeline