diff options
Diffstat (limited to 'sys/kern/kern_jail.c')
| -rw-r--r-- | sys/kern/kern_jail.c | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/sys/kern/kern_jail.c b/sys/kern/kern_jail.c index f5ecfba709b5..bd72c90f4a49 100644 --- a/sys/kern/kern_jail.c +++ b/sys/kern/kern_jail.c @@ -190,6 +190,7 @@ static struct bool_flags pr_flag_allow[NBBY * NBPW] = { {"allow.mount", "allow.nomount", PR_ALLOW_MOUNT}, {"allow.quotas", "allow.noquotas", PR_ALLOW_QUOTAS}, {"allow.socket_af", "allow.nosocket_af", PR_ALLOW_SOCKET_AF}, + {"allow.mlock", "allow.nomlock", PR_ALLOW_MLOCK}, {"allow.reserved_ports", "allow.noreserved_ports", PR_ALLOW_RESERVED_PORTS}, }; @@ -3293,6 +3294,17 @@ prison_priv_check(struct ucred *cred, int priv) return (EPERM); /* + * Conditionnaly allow locking (unlocking) physical pages + * in memory. + */ + case PRIV_VM_MLOCK: + case PRIV_VM_MUNLOCK: + if (cred->cr_prison->pr_allow & PR_ALLOW_MLOCK) + return (0); + else + return (EPERM); + + /* * Conditionally allow jailed root to bind reserved ports. */ case PRIV_NETINET_RESERVEDPORT: @@ -3752,6 +3764,8 @@ SYSCTL_JAIL_PARAM(_allow, quotas, CTLTYPE_INT | CTLFLAG_RW, "B", "Jail may set file quotas"); SYSCTL_JAIL_PARAM(_allow, socket_af, CTLTYPE_INT | CTLFLAG_RW, "B", "Jail may create sockets other than just UNIX/IPv4/IPv6/route"); +SYSCTL_JAIL_PARAM(_allow, mlock, CTLTYPE_INT | CTLFLAG_RW, + "B", "Jail may lock (unlock) physical pages in memory"); SYSCTL_JAIL_PARAM(_allow, reserved_ports, CTLTYPE_INT | CTLFLAG_RW, "B", "Jail may bind sockets to reserved ports"); |