From darrenm@sac.sfbay.sun.com Fri Apr 23 07:09:43 2010 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id o3NE9hJs000244 for ; Fri, 23 Apr 2010 07:09:43 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.4) with ESMTP id o3NE9gSJ020940; Fri, 23 Apr 2010 07:09:42 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0L1C00M0V2066Y00@brm-avmta-1.central.sun.com>; Fri, 23 Apr 2010 08:09:42 -0600 (MDT) Received: from dm-sfbay-02.sfbay.sun.com ([129.146.11.31]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0L1C00B2P206OEC0@brm-avmta-1.central.sun.com>; Fri, 23 Apr 2010 08:09:42 -0600 (MDT) Received: from sac.sfbay.sun.com (sac.SFBay.Sun.COM [129.146.226.132]) by dm-sfbay-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.4) with ESMTP id o3NE9fo8009915; Fri, 23 Apr 2010 07:09:41 -0700 (PDT) Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id o3NE9dda000238; Fri, 23 Apr 2010 07:09:39 -0700 (PDT) Received: (from darrenm@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id o3NE9dQj000234; Fri, 23 Apr 2010 07:09:39 -0700 (PDT) Date: Fri, 23 Apr 2010 07:09:39 -0700 (PDT) From: Darren J Moffat Subject: lofi(7D) in non global zones [PSARC/2010/144 FastTrack timeout 04/30/2010] To: PSARC-ext@sun.com Cc: John.Levon@Oracle.COM Message-id: <201004231409.o3NE9dQj000234@sac.sfbay.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 8525 Template Version: @(#)sac_nextcase 1.70 03/30/10 SMI This information is Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved. 1. Introduction 1.1. Project/Component Working Name: lofi(7D) in non global zones 1.2. Name of Document Author/Supplier: Author: John Levon 1.3 Date of This Document: 23 April, 2010 4. Technical Description 1. Introduction This case enables the safe use of the lofi(7d) driver and utilities within a non-global zone. A patch binding is requested. 2. Device visibility Currently, it's not possible to usefully create lofi devices inside a non-global zone. This project modifies the lofi(7d) driver and related code such that each lofi node is owned by a particular zone. The zone owner of each node is stored as a DDI property "zone", for example: # prtconf -v /dev/lofi/1 lofi, instance #0 Device Minor Nodes: dev=(144,1) .... Minor properties: name='zone' type=string items=1 dev=(144,1) value='ozone' .... This property is looked up by the devnames zone profile code in order to filter visibility of lofi nodes within the zone's mounted /dev instance. Within each zone, lofiadm(1m) is only allowed to see, or modify, the nodes it has created. The global zone can access all nodes, however, for example: # lofiadm Block Device File Options /dev/lofi/1 /rpool/zones/ozone/root/var/lofi/lofi_file_736429_44 - ... If the path cannot be resolved from the global zone (for example, it may reside on an NGZ-mounted NFS path), the File column displays "?". When a zone is shut down, all its lofi devices (and any mounts on top) are unmapped and destroyed. As today, only root users may access and modify lofi devices. 3. Resource limits Currently, lofi has a limit of 128 devices. This case removes this limit as it is not extendable to the multi-zone case. Instead, the number of lofi devices is restricted by each device's associated taskq: the lofi taskq is created as zsched thread, and the zone resource control max-lwps applies. lofiadm traditionally allows direct specification of the minor number to use when creating a mapping. Since direct lofi mounts, this feature is a lot less useful; however, this case continues to support it. A maximum minor number of 65536 is enforced. Note that the minor number space is not virtualized across all zones, thus a non-global zone can observe minor number allocation. However it cannot request mapping information or modify other nodes. 4. Mounting lofi devices The direct mount support introduced in PSARC 2008/290 works as expected in non-global zones. Allowing lofi devices into non-global zones introduces a security issue. Some filesystems (notably UFS) are not sufficiently protected against corrupted or maliciously constructed filesystem images, which lofi allows the zone root user to modify. This could potentially lead to a non-global zone panicking the kernel. Therefore, mounts within a non-global zone are restricted to a given allowed list of filesystems, as described in Section 5 and Section 6. This applies to all mounts not just lofi ones. 5. New vfs flag VSW_ZMOUNT The default list of allowed filesystems is based upon a new vfsdef_t flag VSW_ZMOUNT. If set, then the filesytem may be mounted within a zone, regardless of the fs-allowed value. This flag is Consolidation Private. Today, this flag is set for pseudo filesystems such as proc, network filesystems such as NFS, plus the hsfs filesystem. Future work may enable other filesystems by default. Currently, a non-global zone can create a ZFS volume, but it is not visible inside the zone's /dev. This case doesn't attempt to fix this, although future work may enable it. 6. fs-allowed zone property Although we cannot guarantee the safety of this, this case also defines a new zone property to allow the administrator to add filesystems to this approved list. The property "fs-allowed" is a list of filesystem names that may be mounted from within the zone, in addition to the ones already allowed. For example, to also allow access to pcfs and ufs mounts: # zonecfg -z ozone zonecfg:ozone> set fs-allowed=ufs,pcfs This property does not affect zone mounts administrated by the global zone via "add fs" or "add dataset". This property applies to all zone brands except lx, where it is not allowed to be set. This propety is Committed. 6. References PSARC 1999/463 lofi - fast-track PSARC 2008/290 lofi mount 6354954 lofi support in non-global zones 6946536 would like zvol support in non-global zones 7. Manual page differences --- lofi.man Mon Apr 19 06:38:32 2010 +++ lofi.new Mon Apr 19 06:44:15 2010 @@ -117,15 +117,6 @@ For compatibility purposes, a raw device is also exported with the block device. (For example, newfs(1M)). - - The lofi driver isn't available in a zone and will not work - inside a zone. - - - - - - SunOS 5.11 Last change: 25 Nov 2008 2 @@ -1816,7 +1826,7 @@ svcadm(1M), sysidtool(1M), zfs(1M), zoneadm(1M), priv_str_to_set(3C), kstat(3KSTAT), vfstab(4), attri- butes(5), brands(5), fnmatch(5), lx(5), privileges(5), - resource_controls(5), zones(5) + resource_controls(5), zones(5), hsfs(7fs) System Administration Guide: Solaris Containers-Resource --- hsfs.man Mon Apr 19 06:38:28 2010 +++ hsfs.new Mon Apr 19 06:39:59 2010 @@ -204,7 +204,7 @@ SEE ALSO - mount(1M), mount_hsfs(1M), vfstab(4) + mount(1M), mount_hsfs(1M), vfstab(4), zonecfg(1M) N. V. Phillips and Sony Corporation, System Description Com- @@ -301,6 +301,7 @@ Sierra or ISO 9660 format CD-ROMs; only directory and file names are subject to interpretation by HSFS. + By default, zones may mount this filesystem. --- lofiadm.man Mon Apr 19 06:38:21 2010 +++ lofiadm.new Mon Apr 19 10:57:51 2010 @@ -77,9 +77,11 @@ later. - The lofi driver is not available and will not work inside a - zone. + In the global zone, lofiadm can be used on both the global + zone devices and all devices owned by other non-global zones + on the system. + OPTIONS The following options are supported: @@ -224,6 +226,9 @@ until the block device is used, so it will never be written to if the block device is only opened read-only. + Note that the filename may appear as "?" if it is not + possible to resolve the path in the current context (for + example, if it's an NFS path in a non-global zone). file --- zonecfg.man Mon Apr 19 06:38:47 2010 +++ zonecfg.new Thu Apr 22 05:43:19 2010 @@ -379,7 +379,10 @@ scheduling-class + (global) + fs-allowed + fs dir, special, raw, type, options @@ -613,6 +616,20 @@ digits are acceptable. + global: fs-allowed + + A comma-separated list of additional filesystems that may + be mounted within the zone; for example "ufs,pcfs". By + default, only hsfs(7fs) and network filesystems can be + mounted. + + This property does not apply to filesystems mounted into + the zone via "add fs" or "add dataset". + + WARNING: allowing filesystem mounts other than the default + may allow the zone administrator to compromise the system + with a bogus filesystem image, and is not supported. + fs: dir, special, raw, type, options Values needed to determine how, where, and so forth to @@ -1816,7 +1833,7 @@ svcadm(1M), sysidtool(1M), zfs(1M), zoneadm(1M), priv_str_to_set(3C), kstat(3KSTAT), vfstab(4), attri- butes(5), brands(5), fnmatch(5), lx(5), privileges(5), - resource_controls(5), zones(5) + resource_controls(5), zones(5), hsfs(7fs) System Administration Guide: Solaris Containers-Resource 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: ON 6.5. ARC review type: FastTrack 6.6. ARC Exposure: open From sebastien.roy@oracle.com Mon Apr 26 11:22:27 2010 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id o3QIMRpb018986 for ; Mon, 26 Apr 2010 11:22:27 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail3mpk.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.4) with ESMTP id o3QIMRS0011279 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Mon, 26 Apr 2010 11:22:27 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0L1H00L03XPFAV00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Mon, 26 Apr 2010 11:22:27 -0700 (PDT) Received: from sca-ea-mail-3.sun.com ([192.18.43.21]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0L1H002C0XPESMB0@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Mon, 26 Apr 2010 11:22:26 -0700 (PDT) Received: from acsinet15.oracle.com (acsinet15.oracle.com [141.146.126.227]) by sca-ea-mail-3.sun.com (8.13.6+Sun/8.12.9) with ESMTP id o3QIMQSW024385; Mon, 26 Apr 2010 18:22:26 +0000 (GMT) Received: from acsmt355.oracle.com (acsmt355.oracle.com [141.146.40.155]) by acsinet15.oracle.com (Switch-3.4.2/Switch-3.4.1) with ESMTP id o3PMV9wp012714; Mon, 26 Apr 2010 18:22:24 +0000 (GMT) Received: from abhmt013.oracle.com by acsmt353.oracle.com with ESMTP id 190801551272306061; Mon, 26 Apr 2010 11:21:01 -0700 Received: from [192.168.1.4] (/173.76.16.34) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 26 Apr 2010 11:21:01 -0700 Date: Mon, 26 Apr 2010 14:21:00 -0400 From: Sebastien Roy Subject: Re: lofi(7D) in non global zones [PSARC/2010/144 FastTrack timeout 04/30/2010] In-reply-to: <201004231409.o3NE9dQj000234@sac.sfbay.sun.com> To: Darren J Moffat Cc: PSARC-ext@sun.com, John.Levon@oracle.com Message-id: <4BD5D98C.1030109@oracle.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 X-Source-IP: acsmt355.oracle.com [141.146.40.155] X-Auth-Type: Internal IP X-CT-RefId: str=0001.0A090202.4BD5D9E1.0125:SCFMA4539814,ss=1,fgs=0 References: <201004231409.o3NE9dQj000234@sac.sfbay.sun.com> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9.1.8) Gecko/20100329 Lightning/1.0b1 Thunderbird/3.0.3 Status: RO Content-Length: 1544 On 04/23/10 10:09 AM, Darren J Moffat wrote: > 2. Device visibility > ... > Within each zone, lofiadm(1m) is only allowed to see, or modify, > the nodes it has created. The global zone can access all nodes, > however, for example: > > # lofiadm > Block Device File Options > /dev/lofi/1 /rpool/zones/ozone/root/var/lofi/lofi_file_736429_44 - > ... > > If the path cannot be resolved from the global zone (for example, > it may reside on an NGZ-mounted NFS path), the File column displays > "?". > > When a zone is shut down, all its lofi devices (and any mounts on > top) are unmapped and destroyed. > > As today, only root users may access and modify lofi devices. It wasn't made explicit above, so I'll ask: Can the global zone modify non-global zone nodes in addition to being able to see them via lofiadm? > > 3. Resource limits > > Currently, lofi has a limit of 128 devices. Out of curiosity, why does it currently have this limit? > This case removes this > limit as it is not extendable to the multi-zone case. Instead, the > number of lofi devices is restricted by each device's associated > taskq: the lofi taskq is created as zsched thread, and the zone > resource control max-lwps applies. Are there resources other than threads consumed? More specifically, would there be a need for one to limit the number of lofi devices while not limiting the number of lwps for other purposes? -Seb From johnlev@barman.uk.sun.com Mon Apr 26 11:49:52 2010 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id o3QInqMY019242 for ; Mon, 26 Apr 2010 11:49:52 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.4) with ESMTP id o3QInodj041289 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Mon, 26 Apr 2010 12:49:51 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0L1H00E0FYZ3XJ00@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Mon, 26 Apr 2010 11:49:51 -0700 (PDT) Received: from dm-uk-01.uk.sun.com ([129.156.101.115]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0L1H008SWYZ15760@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Mon, 26 Apr 2010 11:49:50 -0700 (PDT) Received: from barman.uk.sun.com (barman.UK.Sun.COM [129.156.132.12]) by dm-uk-01.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.4) with ESMTP id o3QInkYJ012511; Mon, 26 Apr 2010 19:49:46 +0100 (BST) Received: from johnlev by barman.uk.sun.com with local (Exim 4.42) id 1O6TNJ-0001K0-Pb; Mon, 26 Apr 2010 19:49:46 +0100 X-URL: http://jurassic.eng/~johnlev/ Date: Mon, 26 Apr 2010 19:49:45 +0100 From: John Levon Subject: Re: lofi(7D) in non global zones [PSARC/2010/144 FastTrack timeout 04/30/2010] In-reply-to: <4BD5D98C.1030109@oracle.com> Sender: John Levon To: Sebastien Roy Cc: Darren J Moffat , PSARC-ext@sun.com Message-id: <20100426184945.GC1922@barman.uk.sun.com> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <201004231409.o3NE9dQj000234@sac.sfbay.sun.com> <4BD5D98C.1030109@oracle.com> User-Agent: Mutt/1.5.6i Status: RO Content-Length: 979 On Mon, Apr 26, 2010 at 02:21:00PM -0400, Sebastien Roy wrote: > It wasn't made explicit above, so I'll ask: Can the global zone modify > non-global zone nodes in addition to being able to see them via lofiadm? Yes, although it's obviously not recommended. > > Currently, lofi has a limit of 128 devices. > > Out of curiosity, why does it currently have this limit? To prevent arbitrary-sized allocations of the soft state array. > > This case removes this > > limit as it is not extendable to the multi-zone case. Instead, the > > number of lofi devices is restricted by each device's associated > > taskq: the lofi taskq is created as zsched thread, and the zone > > resource control max-lwps applies. > > Are there resources other than threads consumed? More specifically, > would there be a need for one to limit the number of lofi devices while > not limiting the number of lwps for other purposes? This would be pointless. regards john From Darren.Reed@Sun.COM Mon Apr 26 21:26:47 2010 Received: from sunmail6brm.central.sun.com (sunmail6brm.Central.Sun.COM [129.147.4.169]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id o3R4QlF4007041 for ; Mon, 26 Apr 2010 21:26:47 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail6brm.central.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.4) with ESMTP id o3R4QkD7004926 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Mon, 26 Apr 2010 23:26:46 -0500 (CDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0L1I00801POMH100@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Mon, 26 Apr 2010 21:26:46 -0700 (PDT) Received: from gmp-eb-inf-1.sun.com ([192.18.6.21]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0L1I008TFPOL4510@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Mon, 26 Apr 2010 21:26:46 -0700 (PDT) Received: from fe-emea-13.sun.com (gmp-eb-lb-1-fe1.eu.sun.com [192.18.6.7] (may be forged)) by gmp-eb-inf-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id o3R4Qj9o009960 for ; Tue, 27 Apr 2010 04:26:45 +0000 (GMT) Received: from conversion-daemon.fe-emea-13.sun.com by fe-emea-13.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0L1I00I00PO5E400@fe-emea-13.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Tue, 27 Apr 2010 05:26:36 +0100 (BST) Received: from mintslice.sfbay.sun.com ([unknown] [129.146.106.55]) by fe-emea-13.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0L1I00G80POAS920@fe-emea-13.sun.com>; Tue, 27 Apr 2010 05:26:36 +0100 (BST) Date: Mon, 26 Apr 2010 21:26:47 -0700 From: Darren Reed Subject: Re: lofi(7D) in non global zones [PSARC/2010/144 FastTrack timeout 04/30/2010] In-reply-to: <201004231409.o3NE9dQj000234@sac.sfbay.sun.com> Sender: Darren.Reed@Sun.COM To: John.Levon@oracle.com Cc: Darren J Moffat , PSARC-ext@Sun.COM Message-id: <4BD66787.1060406@Sun.COM> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <201004231409.o3NE9dQj000234@sac.sfbay.sun.com> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-GB; rv:1.9.1.5) Gecko/20091206 Thunderbird/3.0 Status: RO Content-Length: 3441 ... > 4. Mounting lofi devices > > The direct mount support introduced in PSARC 2008/290 works as > expected in non-global zones. > > Allowing lofi devices into non-global zones introduces a security > issue. Some filesystems (notably UFS) are not sufficiently protected > against corrupted or maliciously constructed filesystem images, > which lofi allows the zone root user to modify. This could > potentially lead to a non-global zone panicking the kernel. > > Therefore, mounts within a non-global zone are restricted to a > given allowed list of filesystems, as described in Section 5 and > Section 6. This applies to all mounts not just lofi ones. > > 5. New vfs flag VSW_ZMOUNT > > The default list of allowed filesystems is based upon a new vfsdef_t > flag VSW_ZMOUNT. If set, then the filesytem may be mounted within a > zone, regardless of the fs-allowed value. > > This flag is Consolidation Private. > > Today, this flag is set for pseudo filesystems such as proc, network > filesystems such as NFS, plus the hsfs filesystem. Future work may > enable other filesystems by default. > > Currently, a non-global zone can create a ZFS volume, but it is not > visible inside the zone's /dev. This case doesn't attempt to fix > this, although future work may enable it. > > 6. fs-allowed zone property > > Although we cannot guarantee the safety of this, this case also > defines a new zone property to allow the administrator to add > filesystems to this approved list. The property "fs-allowed" is a > list of filesystem names that may be mounted from within the zone, > in addition to the ones already allowed. For example, to also allow > access to pcfs and ufs mounts: > > # zonecfg -z ozone > zonecfg:ozone> set fs-allowed=ufs,pcfs > > This property does not affect zone mounts administrated by the > global zone via "add fs" or "add dataset". > > This property applies to all zone brands except lx, where it is not > allowed to be set. > > This propety is Committed. It would seem that (6) is at odds with (4) because (6) does not allow you to restrict which filesystems the flag defined by (5) is applied to. Or at least that's the impression I get from the example, which seems at odds with the description. For example, if you do "man filesystem", it talks about things like / and /usr. Yet here "filesystem" seems to mean the type of filesystem. Could you please expand on what is actually meant here? Is "fs-allowed" for _filesystems_ or _types of filesystems_? And whilst the question posed by (4) is correct, what I'm looking for is an example of how to specify which filesystems can be safely used inside the zone under the assumption that there could be bugs in the implementation of any type of filesystem that leads to a "failure" but that not all filesystems are problematic. For example, how do I allow a local zone to use lofiadm to access a ufs filesystem that is in the form of a single file image but at the same time disallow lofiadm to present a ufs image on a usb thumbstick or via nfs? btw, I'll say in advance that if the project doesn't solve the problem of allowing particular images or filesystems being usable by lofiadm, then that's ok with me: just please make the wording more explicit about what is really meant. Darren From johnlev@barman.uk.sun.com Tue Apr 27 03:41:31 2010 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id o3RAfVBK001327 for ; Tue, 27 Apr 2010 03:41:31 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.4) with ESMTP id o3RAfUho004638 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@Sun.COM>; Tue, 27 Apr 2010 03:41:31 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0L1J00A0F717Y900@brm-avmta-1.central.sun.com> for PSARC-ext@Sun.COM (ORCPT PSARC-ext@Sun.COM); Tue, 27 Apr 2010 04:41:31 -0600 (MDT) Received: from dm-uk-02.uk.sun.com ([129.156.101.196]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0L1J0050J7166N30@brm-avmta-1.central.sun.com> for PSARC-ext@Sun.COM (ORCPT PSARC-ext@Sun.COM); Tue, 27 Apr 2010 04:41:30 -0600 (MDT) Received: from barman.uk.sun.com (barman.UK.Sun.COM [129.156.132.12]) by dm-uk-02.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.4) with ESMTP id o3RAfRcs013340; Tue, 27 Apr 2010 11:41:27 +0100 (BST) Received: from johnlev by barman.uk.sun.com with local (Exim 4.42) id 1O6iEJ-0004b1-21; Tue, 27 Apr 2010 11:41:27 +0100 X-URL: http://jurassic.eng/~johnlev/ Date: Tue, 27 Apr 2010 11:41:26 +0100 From: John Levon Subject: Re: lofi(7D) in non global zones [PSARC/2010/144 FastTrack timeout 04/30/2010] In-reply-to: <4BD66787.1060406@Sun.COM> Sender: John Levon To: Darren Reed Cc: Darren J Moffat , PSARC-ext@sun.com Message-id: <20100427104126.GA9319@barman.uk.sun.com> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <201004231409.o3NE9dQj000234@sac.sfbay.sun.com> <4BD66787.1060406@Sun.COM> User-Agent: Mutt/1.5.6i Status: RO Content-Length: 923 On Mon, Apr 26, 2010 at 09:26:47PM -0700, Darren Reed wrote: > > # zonecfg -z ozone > > zonecfg:ozone> set fs-allowed=ufs,pcfs > > Could you please expand on what is actually meant here? > Is "fs-allowed" for _filesystems_ or _types of filesystems_? As the example makes obvious, it's for types of filesystems. > For example, how do I allow a local zone to use lofiadm to > access a ufs filesystem that is in the form of a single file > image but at the same time disallow lofiadm to present a ufs > image on a usb thumbstick or via nfs? You cannot do that, and your assertion that there is a difference between the two cases is wrong. Why do you think there is? If the global zone admin has a particular file system image they want to mount in a zone, the best way to do that is with the existing "add fs" functionality. This case is for images not under the control of the global zone admin. regards john From Darren.Reed@sun.com Tue Apr 27 14:53:03 2010 Received: from sunmail6brm.central.sun.com (sunmail6brm.Central.Sun.COM [129.147.4.169]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id o3RLr3Tm011785 for ; Tue, 27 Apr 2010 14:53:03 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail6brm.central.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.4) with ESMTP id o3RLr2mA005069 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Tue, 27 Apr 2010 16:53:03 -0500 (CDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0L1K0030F24EJ000@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@Sun.COM); Tue, 27 Apr 2010 14:53:02 -0700 (PDT) Received: from gmp-eb-inf-2.sun.com ([192.18.6.24]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0L1K00DKE24DP6D0@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@Sun.COM); Tue, 27 Apr 2010 14:53:02 -0700 (PDT) Received: from fe-emea-09.sun.com (gmp-eb-lb-1-fe1.eu.sun.com [192.18.6.7] (may be forged)) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id o3RLr1rg005488 for ; Tue, 27 Apr 2010 21:53:01 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0L1K00900207TC00@fe-emea-09.sun.com> for PSARC-ext@Sun.COM (ORCPT PSARC-ext@Sun.COM); Tue, 27 Apr 2010 22:52:48 +0100 (BST) Received: from mintslice.sfbay.sun.com ([unknown] [129.146.106.55]) by fe-emea-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0L1K0028G23XK500@fe-emea-09.sun.com>; Tue, 27 Apr 2010 22:52:47 +0100 (BST) Date: Tue, 27 Apr 2010 14:52:59 -0700 From: Darren Reed Subject: Re: lofi(7D) in non global zones [PSARC/2010/144 FastTrack timeout 04/30/2010] In-reply-to: <20100427104126.GA9319@barman.uk.sun.com> Sender: Darren.Reed@sun.com To: John Levon Cc: Darren J Moffat , PSARC-ext@sun.com Message-id: <4BD75CBB.3070908@Sun.COM> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <201004231409.o3NE9dQj000234@sac.sfbay.sun.com> <4BD66787.1060406@Sun.COM> <20100427104126.GA9319@barman.uk.sun.com> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-GB; rv:1.9.1.5) Gecko/20091206 Thunderbird/3.0 Status: RO Content-Length: 2285 On 27/04/10 03:41 AM, John Levon wrote: > On Mon, Apr 26, 2010 at 09:26:47PM -0700, Darren Reed wrote: > >>> # zonecfg -z ozone >>> zonecfg:ozone> set fs-allowed=ufs,pcfs >> >> Could you please expand on what is actually meant here? >> Is "fs-allowed" for _filesystems_ or _types of filesystems_? > > As the example makes obvious, it's for types of filesystems. Please make the supporting documentation clear on that. >> For example, how do I allow a local zone to use lofiadm to >> access a ufs filesystem that is in the form of a single file >> image but at the same time disallow lofiadm to present a ufs >> image on a usb thumbstick or via nfs? > > You cannot do that, and your assertion that there is a difference > between the two cases is wrong. Why do you think there is? Because auto-mounting a filesystem from a USB stick implies that the system somehow trusts the structure of the data on the USB stick. As has been proven in the past with security exploits relating to auto-execution of USB stick files, they are a medium that isn't to be trusted. But that's not to say that they should be forbidden to be used in that way inside a local zone. If, on the other hand, I've got a set of filesystems that have been created in the form of files and I know where they come from, then I have greater trust that they will not cause something bad to happen and it stands to reason that I should be able to allow them to be used in whichever manner is required. Whilst this case does understand that there is a threat from badly constructed filesystems in the form of a file, it does not enable any distinction to be made about where the file data comes from. The origin/location of the data does impact the level of trust that can be put in it. For example: if I trust the data that is made available via NFS, how do I allow UFS image files to be mounted with lofiadm from NFS paths but not USB sticks or DVDs? Anyway, this is really discussion about a feature that is not present in Solaris nor is it presented by this case and something that could possibly be done in the future. With the documentation updated to make it clear that it is "types of filesystems" that are used with "fs-allowed", I have no other issues with what has been presented. Darren From joerg.schilling9ab33xy531fokus.fraunhofer.de@bounce.antispameurope.com Wed Apr 28 02:56:47 2010 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id o3S9ukCm011485 for ; Wed, 28 Apr 2010 02:56:46 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.4) with ESMTP id o3S9uj0P009468 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 28 Apr 2010 02:56:46 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0L1K00H03ZMLCU00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 28 Apr 2010 03:56:45 -0600 (MDT) Received: from sca-ea-mail-3.sun.com ([192.18.43.21]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0L1K0088VZMJ0170@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 28 Apr 2010 03:56:44 -0600 (MDT) Received: from relay44i.sun.com ([192.5.209.118]) by sca-ea-mail-3.sun.com (8.13.6+Sun/8.12.9) with ESMTP id o3S9uEP6024637 for ; Wed, 28 Apr 2010 09:56:43 +0000 (GMT) Received: from mmp42es.mmp.us.syntegra.com ([160.41.221.11] [160.41.221.11]) by relay44i.sun.com with ESMTP id BT-MMP-447984 for PSARC-ext@sun.com; Wed, 28 Apr 2010 09:56:42 +0000 (Z) Received: from relay45i.sun.com (relay45i.sun.com [192.5.209.94]) by mmp42es.mmp.us.syntegra.com with ESMTP id BT-MMP-115102148 for PSARC-ext@sun.com; Wed, 28 Apr 2010 09:56:42 +0000 (Z) Received: from relay03-haj2.antispameurope.com ([83.246.65.53] [83.246.65.53]) by relay4i.sun.com with ESMTP id BT-MMP-15004224 for PSARC-ext@sun.com; Wed, 28 Apr 2010 09:56:42 +0000 (Z) Received: by relay03-haj2.antispameurope.com (ASE-Secure-MTA, from userid 1000) id 0CA1563C099; Wed, 28 Apr 2010 11:56:40 +0200 (CEST) Received: from pluto.fokus.fraunhofer.de (pluto.fokus.fraunhofer.de [195.37.77.164]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by relay03-haj2.antispameurope.com (ASE-Secure-MTA) with ESMTP id EA1D063C098; Wed, 28 Apr 2010 11:56:38 +0200 (CEST) Received: from EXCHSRV.fokus.fraunhofer.de (bohr.fokus.fraunhofer.de [10.147.9.231]) by pluto.fokus.fraunhofer.de (8.14.2/8.14.2) with SMTP id o3S9udAS012189; Wed, 28 Apr 2010 11:56:39 +0200 (MEST) Received: from rigel ([10.147.65.195]) by EXCHSRV.fokus.fraunhofer.de with Microsoft SMTPSVC(6.0.3790.3959); Wed, 28 Apr 2010 11:56:38 +0200 Date: Wed, 28 Apr 2010 11:56:38 +0200 From: Joerg.Schilling@fokus.fraunhofer.de (Joerg Schilling) Subject: Re: lofi(7D) in non global zones [PSARC/2010/144 FastTrack timeout 04/30/2010] In-reply-to: <4BD75CBB.3070908@Sun.COM> Sender: joerg.schilling9ab33xy531fokus.fraunhofer.de@bounce.antispameurope.com To: John.Levon@oracle.com, Darren.Reed@sun.com Cc: PSARC-ext@sun.com, darrenm@sac.sfbay.sun.com Message-id: <4bd80656.1FIwBInFxqCbdXlB%Joerg.Schilling@fokus.fraunhofer.de> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 8BIT X-PMX-Version: 5.4.1.325704 X-Brightmail-Tracker: AAAAAA== X-Antispam: No, score=0.0/5.0, scanned in 0.124sec at (localhost [127.0.0.1]) by smf-spamd v1.3.1 - http://smfs.sf.net/ References: <201004231409.o3NE9dQj000234@sac.sfbay.sun.com> <4BD66787.1060406@Sun.COM> <20100427104126.GA9319@barman.uk.sun.com> <4BD75CBB.3070908@Sun.COM> User-Agent: nail 11.22 3/20/05 X-OriginalArrivalTime: 28 Apr 2010 09:56:38.0848 (UTC) FILETIME=[18897400:01CAE6B9] Status: RO Content-Length: 1024 Darren Reed wrote: > Because auto-mounting a filesystem from a USB stick implies that > the system somehow trusts the structure of the data on the USB > stick. As has been proven in the past with security exploits > relating to auto-execution of USB stick files, they are a medium > that isn't to be trusted. But that's not to say that they should > be forbidden to be used in that way inside a local zone. The question is _why_ a USB stick cannot be trusted. If this is because the filesystem on it could crash the OS, then the filesystem driver in the OS should be hardened. Frank Hofmann and I verified that this is possible by hardening hsfs. Similar things could be done with other filesystems. Jörg -- EMail:joerg@schily.isdn.cs.tu-berlin.de (home) Jörg Schilling D-13353 Berlin js@cs.tu-berlin.de (uni) joerg.schilling@fokus.fraunhofer.de (work) Blog: http://schily.blogspot.com/ URL: http://cdrecord.berlios.de/private/ ftp://ftp.berlios.de/pub/schily From johnlev@barman.uk.sun.com Wed Apr 28 04:56:16 2010 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id o3SBuFiV013108 for ; Wed, 28 Apr 2010 04:56:15 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.4) with ESMTP id o3SBuE2R043021 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@Sun.COM>; Wed, 28 Apr 2010 05:56:15 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0L1L0093P55QDS00@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@Sun.COM (ORCPT PSARC-ext@Sun.COM); Wed, 28 Apr 2010 04:56:14 -0700 (PDT) Received: from dm-uk-02.uk.sun.com ([129.156.101.196]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0L1L001ZW55PZD50@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@Sun.COM (ORCPT PSARC-ext@Sun.COM); Wed, 28 Apr 2010 04:56:14 -0700 (PDT) Received: from barman.uk.sun.com (barman.UK.Sun.COM [129.156.132.12]) by dm-uk-02.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.4) with ESMTP id o3SBuAgb022241; Wed, 28 Apr 2010 12:56:10 +0100 (BST) Received: from johnlev by barman.uk.sun.com with local (Exim 4.42) id 1O75s7-0003nM-R3; Wed, 28 Apr 2010 12:56:07 +0100 X-URL: http://jurassic.eng/~johnlev/ Date: Wed, 28 Apr 2010 12:56:07 +0100 From: John Levon Subject: Re: lofi(7D) in non global zones [PSARC/2010/144 FastTrack timeout 04/30/2010] In-reply-to: <4BD75CBB.3070908@Sun.COM> Sender: John Levon To: Darren Reed Cc: Darren J Moffat , PSARC-ext@sun.com Message-id: <20100428115607.GA14528@barman.uk.sun.com> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <201004231409.o3NE9dQj000234@sac.sfbay.sun.com> <4BD66787.1060406@Sun.COM> <20100427104126.GA9319@barman.uk.sun.com> <4BD75CBB.3070908@Sun.COM> User-Agent: Mutt/1.5.6i Status: RO Content-Length: 228 On Tue, Apr 27, 2010 at 02:52:59PM -0700, Darren Reed wrote: > With the documentation updated to make it clear that it is > "types of filesystems" that are used with "fs-allowed", I don't know how I could be more clear. john From Darren.Moffat@Oracle.COM Wed Apr 28 05:22:07 2010 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id o3SCM7Gv013336 for ; Wed, 28 Apr 2010 05:22:07 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.4) with ESMTP id o3SCM14Z061669; Wed, 28 Apr 2010 06:22:05 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0L1L00F0F6CSN600@nwk-avmta-2.sfbay.sun.com>; Wed, 28 Apr 2010 05:22:04 -0700 (PDT) Received: from sca-ea-mail-4.sun.com ([192.18.43.22]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0L1L002956CRA4F0@nwk-avmta-2.sfbay.sun.com>; Wed, 28 Apr 2010 05:22:03 -0700 (PDT) Received: from acsinet15.oracle.com (acsinet15.oracle.com [141.146.126.227]) by sca-ea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id o3SCM39T013847; Wed, 28 Apr 2010 12:22:03 +0000 (GMT) Received: from acsmt355.oracle.com (acsmt355.oracle.com [141.146.40.155]) by acsinet15.oracle.com (Switch-3.4.2/Switch-3.4.1) with ESMTP id o3SCM020004555; Wed, 28 Apr 2010 12:22:01 +0000 (GMT) Received: from abhmt010.oracle.com by acsmt355.oracle.com with ESMTP id 196690891272457252; Wed, 28 Apr 2010 05:20:52 -0700 Received: from [10.7.251.221] (/10.7.251.221) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 28 Apr 2010 05:20:52 -0700 Date: Wed, 28 Apr 2010 13:20:49 +0100 From: Darren J Moffat Subject: Re: lofi(7D) in non global zones [PSARC/2010/144 FastTrack timeout 04/30/2010] In-reply-to: <20100428115607.GA14528@barman.uk.sun.com> To: John Levon Cc: Darren Reed , Darren J Moffat , PSARC-ext@sun.com Message-id: <4BD82821.9080401@Oracle.COM> Organization: Oracle Solaris Security MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 X-Source-IP: acsmt355.oracle.com [141.146.40.155] X-Auth-Type: Internal IP X-CT-RefId: str=0001.0A090204.4BD8286A.00A1:SCFMA4539814,ss=1,fgs=0 References: <201004231409.o3NE9dQj000234@sac.sfbay.sun.com> <4BD66787.1060406@Sun.COM> <20100427104126.GA9319@barman.uk.sun.com> <4BD75CBB.3070908@Sun.COM> <20100428115607.GA14528@barman.uk.sun.com> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9.1.8) Gecko/20100315 Lightning/1.0b1 OracleBeehiveExtension/1.0.0.0pre3 Thunderbird/3.0.3 Status: RO Content-Length: 609 On 28/04/2010 12:56, John Levon wrote: > On Tue, Apr 27, 2010 at 02:52:59PM -0700, Darren Reed wrote: > >> With the documentation updated to make it clear that it is >> "types of filesystems" that are used with "fs-allowed", > > I don't know how I could be more clear. Agreed, I don't see the problem and I think it is totally clear from the context and the examples what is intended here. Ultimately it is upto the man page writers to make sure it is clear, unless what Darren is suggesting is that 'fs-allowed' is not a suitable keyword and wants something like 'fs-type-allowed'. -- Darren J Moffat From Darren.Reed@sun.com Wed Apr 28 17:11:47 2010 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id o3T0BlPu000405 for ; Wed, 28 Apr 2010 17:11:47 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail2sca.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.4) with ESMTP id o3T0BllA000638 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Wed, 28 Apr 2010 17:11:47 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0L1M00I0P37N9000@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 28 Apr 2010 17:11:47 -0700 (PDT) Received: from gmp-eb-inf-2.sun.com ([192.18.6.24]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0L1M00BH337KQN10@nwk-avmta-1.sfbay.Sun.COM> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Wed, 28 Apr 2010 17:11:45 -0700 (PDT) Received: from fe-emea-10.sun.com (gmp-eb-lb-1-fe1.eu.sun.com [192.18.6.7] (may be forged)) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id o3T0BiYt025215 for ; Thu, 29 Apr 2010 00:11:44 +0000 (GMT) Received: from conversion-daemon.fe-emea-10.sun.com by fe-emea-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0L1M001002VPLO00@fe-emea-10.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 29 Apr 2010 01:11:07 +0100 (BST) Received: from mintslice.sfbay.sun.com ([unknown] [129.146.106.55]) by fe-emea-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0L1M00K1P36GIL00@fe-emea-10.sun.com>; Thu, 29 Apr 2010 01:11:07 +0100 (BST) Date: Wed, 28 Apr 2010 17:11:19 -0700 From: Darren Reed Subject: Re: lofi(7D) in non global zones [PSARC/2010/144 FastTrack timeout 04/30/2010] In-reply-to: <4BD82821.9080401@Oracle.COM> Sender: Darren.Reed@sun.com To: Darren J Moffat Cc: John Levon , Darren J Moffat , PSARC-ext@sun.com Message-id: <4BD8CEA7.9050104@Sun.COM> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <201004231409.o3NE9dQj000234@sac.sfbay.sun.com> <4BD66787.1060406@Sun.COM> <20100427104126.GA9319@barman.uk.sun.com> <4BD75CBB.3070908@Sun.COM> <20100428115607.GA14528@barman.uk.sun.com> <4BD82821.9080401@Oracle.COM> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-GB; rv:1.9.1.5) Gecko/20091206 Thunderbird/3.0 Status: RO Content-Length: 933 On 28/04/10 05:20 AM, Darren J Moffat wrote: > On 28/04/2010 12:56, John Levon wrote: >> On Tue, Apr 27, 2010 at 02:52:59PM -0700, Darren Reed wrote: >> >>> With the documentation updated to make it clear that it is >>> "types of filesystems" that are used with "fs-allowed", >> >> I don't know how I could be more clear. > > Agreed, I don't see the problem and I think it is totally clear from > the context and the examples what is intended here. > > Ultimately it is upto the man page writers to make sure it is clear, > unless what Darren is suggesting is that 'fs-allowed' is not a > suitable keyword and wants something like 'fs-type-allowed'. I suppose we're caught between two different uses of the word "filesystem" :-( What does the project team think about "fs-type-allowed"? To me it seems preferable because it means that the keyword is not dependant on context or a following example to be understood. Darren From johnlev@barman.uk.sun.com Thu Apr 29 04:45:57 2010 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id o3TBjvhI029342 for ; Thu, 29 Apr 2010 04:45:57 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.4) with ESMTP id o3TBjumS033703 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@Sun.COM>; Thu, 29 Apr 2010 05:45:57 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0L1M00C03ZCLCN00@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@Sun.COM (ORCPT PSARC-ext@Sun.COM); Thu, 29 Apr 2010 04:45:57 -0700 (PDT) Received: from dm-uk-01.uk.sun.com ([129.156.101.115]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0L1M00CO3ZCJ9000@nwk-avmta-2.sfbay.sun.com> for PSARC-ext@Sun.COM (ORCPT PSARC-ext@Sun.COM); Thu, 29 Apr 2010 04:45:56 -0700 (PDT) Received: from barman.uk.sun.com (barman.UK.Sun.COM [129.156.132.12]) by dm-uk-01.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.4) with ESMTP id o3TBjqMd023330; Thu, 29 Apr 2010 12:45:52 +0100 (BST) Received: from johnlev by barman.uk.sun.com with local (Exim 4.42) id 1O7SBj-000602-Oy; Thu, 29 Apr 2010 12:45:51 +0100 X-URL: http://jurassic.eng/~johnlev/ Date: Thu, 29 Apr 2010 12:45:51 +0100 From: John Levon Subject: Re: lofi(7D) in non global zones [PSARC/2010/144 FastTrack timeout 04/30/2010] In-reply-to: <4BD8CEA7.9050104@Sun.COM> Sender: John Levon To: Darren Reed Cc: Darren J Moffat , Darren J Moffat , PSARC-ext@sun.com Message-id: <20100429114551.GA22988@barman.uk.sun.com> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <201004231409.o3NE9dQj000234@sac.sfbay.sun.com> <4BD66787.1060406@Sun.COM> <20100427104126.GA9319@barman.uk.sun.com> <4BD75CBB.3070908@Sun.COM> <20100428115607.GA14528@barman.uk.sun.com> <4BD82821.9080401@Oracle.COM> <4BD8CEA7.9050104@Sun.COM> User-Agent: Mutt/1.5.6i Status: RO Content-Length: 381 On Wed, Apr 28, 2010 at 05:11:19PM -0700, Darren Reed wrote: > What does the project team think about "fs-type-allowed"? It would be fs-types-allowed. I don't really like it, it's unncessary typing. Any attempt to pass paths to fs-allowed will fail validation anyway, it's functionality that shouldn't really be used in in most cases, and it's semi-subtle anyway. regards john From Darren.Reed@sun.com Thu Apr 29 14:41:40 2010 Received: from sunmail6brm.central.sun.com (sunmail6brm.Central.Sun.COM [129.147.4.169]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id o3TLfdms012427 for ; Thu, 29 Apr 2010 14:41:40 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail6brm.central.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.4) with ESMTP id o3TLfdXO004439 for <@sunmail2sca.sfbay.sun.com:PSARC-ext@sun.com>; Thu, 29 Apr 2010 16:41:39 -0500 (CDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0L1N00607QXF8G00@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 29 Apr 2010 15:41:39 -0600 (MDT) Received: from gmp-eb-inf-1.sun.com ([192.18.6.21]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0L1N003DYQXDAY60@brm-avmta-1.central.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 29 Apr 2010 15:41:37 -0600 (MDT) Received: from fe-emea-09.sun.com (gmp-eb-lb-1-fe1.eu.sun.com [192.18.6.7] (may be forged)) by gmp-eb-inf-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id o3TLfaao001168 for ; Thu, 29 Apr 2010 21:41:36 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) id <0L1N00300QVAF500@fe-emea-09.sun.com> for PSARC-ext@sun.com (ORCPT PSARC-ext@sun.com); Thu, 29 Apr 2010 22:41:11 +0100 (BST) Received: from mintslice.sfbay.sun.com ([unknown] [129.146.106.55]) by fe-emea-09.sun.com (Sun Java(tm) System Messaging Server 7u2-7.04 64bit (built Jul 2 2009)) with ESMTPSA id <0L1N00JVYQWGOZ90@fe-emea-09.sun.com>; Thu, 29 Apr 2010 22:41:11 +0100 (BST) Date: Thu, 29 Apr 2010 14:41:20 -0700 From: Darren Reed Subject: Re: lofi(7D) in non global zones [PSARC/2010/144 FastTrack timeout 04/30/2010] In-reply-to: <20100429114551.GA22988@barman.uk.sun.com> Sender: Darren.Reed@sun.com To: John Levon Cc: Darren J Moffat , Darren J Moffat , PSARC-ext@sun.com Message-id: <4BD9FD00.7090509@Sun.COM> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <201004231409.o3NE9dQj000234@sac.sfbay.sun.com> <4BD66787.1060406@Sun.COM> <20100427104126.GA9319@barman.uk.sun.com> <4BD75CBB.3070908@Sun.COM> <20100428115607.GA14528@barman.uk.sun.com> <4BD82821.9080401@Oracle.COM> <4BD8CEA7.9050104@Sun.COM> <20100429114551.GA22988@barman.uk.sun.com> User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-GB; rv:1.9.1.5) Gecko/20091206 Thunderbird/3.0 Status: RO Content-Length: 497 On 29/04/10 04:45 AM, John Levon wrote: > On Wed, Apr 28, 2010 at 05:11:19PM -0700, Darren Reed wrote: > > >> What does the project team think about "fs-type-allowed"? >> > It would be fs-types-allowed. > > I don't really like it, it's unncessary typing. Any attempt to pass > paths to fs-allowed will fail validation anyway, it's functionality that > shouldn't really be used in in most cases, and it's semi-subtle anyway. > I'll accept the project team's advice on this. Darren