]> git.proxmox.com Git - mirror_zfs.git/commit - module/Kbuild.in
Add Linux namespace delegation support
authorWill Andrews <will.andrews@klarasystems.com>
Sun, 21 Feb 2021 16:19:43 +0000 (10:19 -0600)
committerBrian Behlendorf <behlendorf1@llnl.gov>
Fri, 10 Jun 2022 16:51:46 +0000 (09:51 -0700)
commit4ed5e25074ffec266df38556d9b3a928c5e0dee9
tree930f2397ca27e885ca33c05728802d7f19021f08
parenta1aa8f14c864b6851649f9c3e74e9f12e6518edd
Add Linux namespace delegation support

This allows ZFS datasets to be delegated to a user/mount namespace
Within that namespace, only the delegated datasets are visible
Works very similarly to Zones/Jailes on other ZFS OSes

As a user:
```
 $ unshare -Um
 $ zfs list
no datasets available
 $ echo $$
1234
```

As root:
```
 # zfs list
NAME                            ZONED  MOUNTPOINT
containers                      off    /containers
containers/host                 off    /containers/host
containers/host/child           off    /containers/host/child
containers/host/child/gchild    off    /containers/host/child/gchild
containers/unpriv               on     /unpriv
containers/unpriv/child         on     /unpriv/child
containers/unpriv/child/gchild  on     /unpriv/child/gchild

 # zfs zone /proc/1234/ns/user containers/unpriv
```

Back to the user namespace:
```
 $ zfs list
NAME                             USED  AVAIL     REFER  MOUNTPOINT
containers                       129M  47.8G       24K  /containers
containers/unpriv                128M  47.8G       24K  /unpriv
containers/unpriv/child          128M  47.8G      128M  /unpriv/child
```

Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Signed-off-by: Will Andrews <will.andrews@klarasystems.com>
Signed-off-by: Allan Jude <allan@klarasystems.com>
Signed-off-by: Mateusz Piotrowski <mateusz.piotrowski@klarasystems.com>
Co-authored-by: Allan Jude <allan@klarasystems.com>
Co-authored-by: Mateusz Piotrowski <mateusz.piotrowski@klarasystems.com>
Sponsored-by: Buddy <https://buddy.works>
Closes #12263
33 files changed:
cmd/zfs/zfs_main.c
config/kernel-user-ns-inum.m4 [new file with mode: 0644]
config/kernel.m4
contrib/pyzfs/libzfs_core/_constants.py
include/libzfs.h
include/os/linux/spl/sys/zone.h
include/sys/fs/zfs.h
lib/libspl/include/sys/types.h
lib/libspl/include/zone.h
lib/libspl/os/linux/zone.c
lib/libuutil/libuutil.abi
lib/libzfs/libzfs.abi
lib/libzfs/libzfs_util.c
lib/libzfs/os/linux/libzfs_util_os.c
lib/libzfs_core/libzfs_core.abi
man/Makefile.am
man/man7/zfsprops.7
man/man8/zfs-unzone.8 [new symlink]
man/man8/zfs-zone.8 [new file with mode: 0644]
module/Kbuild.in
module/os/linux/spl/spl-generic.c
module/os/linux/spl/spl-zone.c [new file with mode: 0644]
module/os/linux/zfs/policy.c
module/os/linux/zfs/zfs_ioctl_os.c
module/os/linux/zfs/zfs_vfsops.c
module/os/linux/zfs/zpl_super.c
tests/runfiles/linux.run
tests/zfs-tests/include/commands.cfg
tests/zfs-tests/tests/Makefile.am
tests/zfs-tests/tests/functional/user_namespace/user_namespace_001.ksh
tests/zfs-tests/tests/functional/user_namespace/user_namespace_002.ksh [new file with mode: 0755]
tests/zfs-tests/tests/functional/user_namespace/user_namespace_003.ksh [new file with mode: 0755]
tests/zfs-tests/tests/functional/user_namespace/user_namespace_004.ksh [new file with mode: 0755]