mirror_zfs/include
Brian Behlendorf d34d4f97a8
snapdir: add 'disabled' value to make .zfs inaccessible
In some environments, just making the .zfs control dir hidden from sight
might not be enough. In particular, the following scenarios might
warrant not allowing access at all:
- old snapshots with wrong permissions/ownership
- old snapshots with exploitable setuid/setgid binaries
- old snapshots with sensitive contents

Introducing a new 'disabled' value that not only hides the control dir,
but prevents access to its contents by returning ENOENT solves all of
the above.

The new property value takes advantage of 'iuv' semantics ("ignore
unknown value") to automatically fall back to the old default value when
a pool is accessed by an older version of ZFS that doesn't yet know
about 'disabled' semantics.

I think that technically the zfs_dirlook change is enough to prevent
access, but preventing lookups and dir entries in an already opened .zfs
handle might also be a good idea to prevent races when modifying the
property at runtime.

Add zfs_snapshot_no_setuid parameter to control whether automatically
mounted snapshots have the setuid mount option set or not.

this could be considered a partial fix for one of the scenarios
mentioned in desired.

Reviewed-by: Alexander Motin <mav@FreeBSD.org>
Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Reviewed-by: Tino Reichardt <milky-zfs@mcmilk.de>
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Co-authored-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Closes #3963
Closes #16587
2024-10-02 09:12:02 -07:00
..
os snapdir: add 'disabled' value to make .zfs inaccessible 2024-10-02 09:12:02 -07:00
sys snapdir: add 'disabled' value to make .zfs inaccessible 2024-10-02 09:12:02 -07:00
.gitignore OpenZFS restructuring - move platform specific sources 2019-09-06 11:26:26 -07:00
cityhash.h zcommon: add specialized versions of cityhash4 2024-09-19 15:18:59 -07:00
libnvpair.h nvpair: Constify string functions 2023-03-14 15:25:50 -07:00
libuutil_common.h Replace dead opensolaris.org license link 2022-07-11 14:16:13 -07:00
libuutil_impl.h libuutil: deobfuscate internal pointers 2022-11-03 09:57:05 -07:00
libuutil.h Cleanup: Remove unused uu_pname code 2022-09-19 17:33:52 -07:00
libzdb.h libzdb: Initial breakout of libzdb 2024-02-05 10:00:41 -08:00
libzfs_core.h Add DDT prune command 2024-09-04 14:17:02 -07:00
libzfs.h Add DDT prune command 2024-09-04 14:17:02 -07:00
libzfsbootenv.h lib{efi,avl,share,tpool,zfs_core,zfsbootenv,zutil}: -fvisibility=hidden 2021-06-09 17:04:32 -07:00
libzutil.h Parallel pool import 2024-04-22 09:42:38 -07:00
Makefile.am value strings: pretty printers for flags and enums 2024-09-05 13:40:05 -07:00
thread_pool.h Replace dead opensolaris.org license link 2022-07-11 14:16:13 -07:00
zfeature_common.h Support for longnames for files/directories (Linux part) 2024-10-01 13:40:27 -07:00
zfs_comutil.h Replace dead opensolaris.org license link 2022-07-11 14:16:13 -07:00
zfs_deleg.h Replace dead opensolaris.org license link 2022-07-11 14:16:13 -07:00
zfs_fletcher.h Drop lying to the compiler in the fletcher4 code 2023-03-24 10:29:19 -07:00
zfs_namecheck.h Replace dead opensolaris.org license link 2022-07-11 14:16:13 -07:00
zfs_prop.h Replace dead opensolaris.org license link 2022-07-11 14:16:13 -07:00
zfs_valstr.h value strings: pretty printers for flags and enums 2024-09-05 13:40:05 -07:00