c/mirror_zfs
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_zfs.git synced 2026-05-25 11:47:43 +03:00
Code Issues Packages Projects Releases Wiki Activity

Add Linux namespace delegation support

Browse Source 
This allows ZFS datasets to be delegated to a user/mount namespace
Within that namespace, only the delegated datasets are visible
Works very similarly to Zones/Jailes on other ZFS OSes

As a user:
```
 $ unshare -Um
 $ zfs list
no datasets available
 $ echo $$
1234
```

As root:
```
 # zfs list
NAME                            ZONED  MOUNTPOINT
containers                      off    /containers
containers/host                 off    /containers/host
containers/host/child           off    /containers/host/child
containers/host/child/gchild    off    /containers/host/child/gchild
containers/unpriv               on     /unpriv
containers/unpriv/child         on     /unpriv/child
containers/unpriv/child/gchild  on     /unpriv/child/gchild

 # zfs zone /proc/1234/ns/user containers/unpriv
```

Back to the user namespace:
```
 $ zfs list
NAME                             USED  AVAIL     REFER  MOUNTPOINT
containers                       129M  47.8G       24K  /containers
containers/unpriv                128M  47.8G       24K  /unpriv
containers/unpriv/child          128M  47.8G      128M  /unpriv/child
```

Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Signed-off-by: Will Andrews <will.andrews@klarasystems.com>
Signed-off-by: Allan Jude <allan@klarasystems.com>
Signed-off-by: Mateusz Piotrowski <mateusz.piotrowski@klarasystems.com>
Co-authored-by: Allan Jude <allan@klarasystems.com>
Co-authored-by: Mateusz Piotrowski <mateusz.piotrowski@klarasystems.com>
Sponsored-by: Buddy <https://buddy.works>
Closes #12263
This commit is contained in:
Will Andrews
2021-02-21 10:19:43 -06:00
committed by Brian Behlendorf
parent a1aa8f14c8
commit 4ed5e25074
33 changed files with 1166 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
module/os/linux/zfs/zfs_ioctl_os.c
+47
View File
@@ -37,6 +37,7 @@
* Copyright 2017 RackTop Systems.
* Copyright (c) 2017 Open-E, Inc. All Rights Reserved.
* Copyright (c) 2019 Datto Inc.
* Copyright (c) 2021 Klara, Inc.
*/
#include <sys/types.h>
@@ -150,6 +151,48 @@ out:
}
static int
zfs_ioc_userns_attach(zfs_cmd_t *zc)
{
int error;
if (zc == NULL)
return (SET_ERROR(EINVAL));
error = zone_dataset_attach(CRED(), zc->zc_name, zc->zc_cleanup_fd);
/*
* Translate ENOTTY to ZFS_ERR_NOT_USER_NAMESPACE as we just arrived
* back from the SPL layer, which does not know about ZFS_ERR_* errors.
* See the comment at the user_ns_get() function in spl-zone.c for
* details.
*/
if (error == ENOTTY)
error = ZFS_ERR_NOT_USER_NAMESPACE;
return (error);
}
static int
zfs_ioc_userns_detach(zfs_cmd_t *zc)
{
int error;
if (zc == NULL)
return (SET_ERROR(EINVAL));
error = zone_dataset_detach(CRED(), zc->zc_name, zc->zc_cleanup_fd);
/*
* See the comment in zfs_ioc_userns_attach() for details on what is
* going on here.
*/
if (error == ENOTTY)
error = ZFS_ERR_NOT_USER_NAMESPACE;
return (error);
}
uint64_t
zfs_max_nvlist_src_size_os(void)
{
@@ -168,6 +211,10 @@ zfs_ioctl_update_mount_cache(const char *dsname)
void
zfs_ioctl_init_os(void)
{
zfs_ioctl_register_dataset_nolog(ZFS_IOC_USERNS_ATTACH,
zfs_ioc_userns_attach, zfs_secpolicy_config, POOL_CHECK_NONE);
zfs_ioctl_register_dataset_nolog(ZFS_IOC_USERNS_DETACH,
zfs_ioc_userns_detach, zfs_secpolicy_config, POOL_CHECK_NONE);
}
#ifdef CONFIG_COMPAT