Change Details

Handle JAIL_SYS_DISABLE the same as JAIL_SYS_NEW with an empty rules specification, coherently with jail_get(). Also accept JAIL_SYS_DISABLE in "mac.do" without "mac.do.rules" being specified. The default value for "mac.do", if not passed explicitly, is either JAIL_SYS_NEW if "mac.do.rules" is present and non-empty, or JAIL_SYS_DISABLE if present and empty or not present. Perform all cheap sanity checks in jail_check(), and have these materialized as well in jail_set() under INVARIANTS. Cheap checks are type and coherency checks between the values of "mac.do" and "mac.do.rules". They don't include parsing the "mac.do.rules" string but just checking its length (when applicable). In a nutshell, JAIL_SYS_DISABLE and JAIL_SYS_INHERIT are allowed iff "mac.do.rules" isn't specified or is with an empty string, and JAIL_SYS_NEW is allowed iff "mac.do.rules" is specified (the latter may be empty, in which case this is equivalent to JAIL_SYS_DISABLE). Normally, vfs_getopts() is the function to use to read string options. Because we need the length of the "mac.do.rules" string to check it, in order to avoid double search within jail options in jail_check(), we use vfs_getopt() instead, but perform some additional checks afterwards (the same as those performed by vfs_getopts()).

This revision is part of a series. Click on the `Stack` tab below to see the context. This series has also been squeezed into D47633 to provide an overall view. Commit message: Handle JAIL_SYS_DISABLE the same as JAIL_SYS_NEW with an empty rules specification, coherently with jail_get(). Also accept JAIL_SYS_DISABLE in "mac.do" without "mac.do.rules" being specified. The default value for "mac.do", if not passed explicitly, is either JAIL_SYS_NEW if "mac.do.rules" is present and non-empty, or JAIL_SYS_DISABLE if present and empty or not present. Perform all cheap sanity checks in jail_check(), and have these materialized as well in jail_set() under INVARIANTS. Cheap checks are type and coherency checks between the values of "mac.do" and "mac.do.rules". They don't include parsing the "mac.do.rules" string but just checking its length (when applicable). In a nutshell, JAIL_SYS_DISABLE and JAIL_SYS_INHERIT are allowed iff "mac.do.rules" isn't specified or is with an empty string, and JAIL_SYS_NEW is allowed iff "mac.do.rules" is specified (the latter may be empty, in which case this is equivalent to JAIL_SYS_DISABLE). Normally, vfs_getopts() is the function to use to read string options. Because we need the length of the "mac.do.rules" string to check it, in order to avoid double search within jail options in jail_check(), we use vfs_getopt() instead, but perform some additional checks afterwards (the same as those performed by vfs_getopts()).

This revision is part of a series. Click on the `Stack` tab below to see the context. This series has also been squeezed into D47633 to provide an overall view. Commit message: Handle JAIL_SYS_DISABLE the same as JAIL_SYS_NEW with an empty rules specification, coherently with jail_get(). Also accept JAIL_SYS_DISABLE in "mac.do" without "mac.do.rules" being specified. The default value for "mac.do", if not passed explicitly, is either JAIL_SYS_NEW if "mac.do.rules" is present and non-empty, or JAIL_SYS_DISABLE if present and empty or not present. Perform all cheap sanity checks in jail_check(), and have these materialized as well in jail_set() under INVARIANTS. Cheap checks are type and coherency checks between the values of "mac.do" and "mac.do.rules". They don't include parsing the "mac.do.rules" string but just checking its length (when applicable). In a nutshell, JAIL_SYS_DISABLE and JAIL_SYS_INHERIT are allowed iff "mac.do.rules" isn't specified or is with an empty string, and JAIL_SYS_NEW is allowed iff "mac.do.rules" is specified (the latter may be empty, in which case this is equivalent to JAIL_SYS_DISABLE). Normally, vfs_getopts() is the function to use to read string options. Because we need the length of the "mac.do.rules" string to check it, in order to avoid double search within jail options in jail_check(), we use vfs_getopt() instead, but perform some additional checks afterwards (the same as those performed by vfs_getopts()).