Add config defaults for the mlock and fusefs mount jail params - #775
Merged
Merged
Conversation
Extracted from the defaults added in #671. The allow_mlock and allow_mount_fusefs properties map to jail(8) parameters that the launch parameters forward on hosts providing them, mount_linprocfs completes the iocage mount_* property set, and the duplicated priority key is removed. allow_mlock defaults to 0, because the iovec launch path treats a parameter without a value as a set flag, which would enable mlock in every jail.
The AST test fails on the duplicated priority key that the previous commit removes, because a repeated key in a dict literal silently drops the earlier value. The jail param tests prove that allow_mlock and allow_mount_fusefs travel from the config defaults through the launch parameters into a running jail.
The allow.mount.fusefs jail param registers only while the module is loaded, so the guest loads it persistently to run the fusefs mount param test without skipping.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
allow_mlockandallow_mount_fusefs, which map to jail(8) parameters and reach a started jail through the launch parameters.mount_linprocfs, completing the iocagemount_*property set.allow.mount.*jail params register only while the filesystem module is loaded; the new test skips on hosts without it.