mirror of
https://git.proxmox.com/git/mirror_zfs
synced 2025-10-31 18:31:31 +00:00
4ed5e25074
This allows ZFS datasets to be delegated to a user/mount namespace Within that namespace, only the delegated datasets are visible Works very similarly to Zones/Jailes on other ZFS OSes As a user: ``` $ unshare -Um $ zfs list no datasets available $ echo $$ 1234 ``` As root: ``` # zfs list NAME ZONED MOUNTPOINT containers off /containers containers/host off /containers/host containers/host/child off /containers/host/child containers/host/child/gchild off /containers/host/child/gchild containers/unpriv on /unpriv containers/unpriv/child on /unpriv/child containers/unpriv/child/gchild on /unpriv/child/gchild # zfs zone /proc/1234/ns/user containers/unpriv ``` Back to the user namespace: ``` $ zfs list NAME USED AVAIL REFER MOUNTPOINT containers 129M 47.8G 24K /containers containers/unpriv 128M 47.8G 24K /unpriv containers/unpriv/child 128M 47.8G 128M /unpriv/child ``` Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Signed-off-by: Will Andrews <will.andrews@klarasystems.com> Signed-off-by: Allan Jude <allan@klarasystems.com> Signed-off-by: Mateusz Piotrowski <mateusz.piotrowski@klarasystems.com> Co-authored-by: Allan Jude <allan@klarasystems.com> Co-authored-by: Mateusz Piotrowski <mateusz.piotrowski@klarasystems.com> Sponsored-by: Buddy <https://buddy.works> Closes #12263
59 lines
1.8 KiB
C
59 lines
1.8 KiB
C
/*
|
|
* Copyright (C) 2007-2010 Lawrence Livermore National Security, LLC.
|
|
* Copyright (C) 2007 The Regents of the University of California.
|
|
* Produced at Lawrence Livermore National Laboratory (cf, DISCLAIMER).
|
|
* Written by Brian Behlendorf <behlendorf1@llnl.gov>.
|
|
* UCRL-CODE-235197
|
|
*
|
|
* This file is part of the SPL, Solaris Porting Layer.
|
|
*
|
|
* The SPL is free software; you can redistribute it and/or modify it
|
|
* under the terms of the GNU General Public License as published by the
|
|
* Free Software Foundation; either version 2 of the License, or (at your
|
|
* option) any later version.
|
|
*
|
|
* The SPL is distributed in the hope that it will be useful, but WITHOUT
|
|
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
|
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
|
* for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License along
|
|
* with the SPL. If not, see <http://www.gnu.org/licenses/>.
|
|
*/
|
|
|
|
#ifndef _SPL_ZONE_H
|
|
#define _SPL_ZONE_H
|
|
|
|
#include <sys/byteorder.h>
|
|
#include <sys/cred.h>
|
|
|
|
#include <linux/cred.h>
|
|
#include <linux/user_namespace.h>
|
|
|
|
/*
|
|
* Attach the given dataset to the given user namespace.
|
|
*/
|
|
extern int zone_dataset_attach(cred_t *, const char *, int);
|
|
|
|
/*
|
|
* Detach the given dataset from the given user namespace.
|
|
*/
|
|
extern int zone_dataset_detach(cred_t *, const char *, int);
|
|
|
|
/*
|
|
* Returns true if the named pool/dataset is visible in the current zone.
|
|
*/
|
|
extern int zone_dataset_visible(const char *dataset, int *write);
|
|
|
|
int spl_zone_init(void);
|
|
void spl_zone_fini(void);
|
|
|
|
extern unsigned int crgetzoneid(const cred_t *);
|
|
extern unsigned int global_zoneid(void);
|
|
extern boolean_t inglobalzone(proc_t *);
|
|
|
|
#define INGLOBALZONE(x) inglobalzone(x)
|
|
#define GLOBAL_ZONEID global_zoneid()
|
|
|
|
#endif /* SPL_ZONE_H */
|