sys/kern/kern_jail.c

198 	"allow.set_hostname",
199 	"allow.sysvipc",
200 	"allow.raw_sockets",
201 	"allow.chflags",
202 	"allow.mount",
203 	"allow.quotas",
204 	"allow.socket_af",
205 	"allow.mount.devfs",
206 	"allow.mount.nullfs",
207 	"allow.mount.zfs",
208 	"allow.mount.procfs",
209 	"allow.mount.tmpfs",
210 	"allow.mount.fdescfs",
211 	"allow.mount.linprocfs",
212 	"allow.mount.linsysfs",
217 	"allow.noset_hostname",
218 	"allow.nosysvipc",
219 	"allow.noraw_sockets",
220 	"allow.nochflags",
221 	"allow.nomount",
222 	"allow.noquotas",
223 	"allow.nosocket_af",
224 	"allow.mount.nodevfs",
225 	"allow.mount.nonullfs",
226 	"allow.mount.nozfs",
227 	"allow.mount.noprocfs",
228 	"allow.mount.notmpfs",
229 	"allow.mount.nofdescfs",
230 	"allow.mount.nolinprocfs",
231 	"allow.mount.nolinsysfs",
1583 		/* Give a default name of the jid.  Also allow the name to be
1789 		/* Clear allow bits in all children. */
2419 	 * Do not allow a process to attach to a prison that is not
2885  * Returns 0 on success, EAFNOSUPPORT if the jail doesn't allow IPv4.
2919  * Return EAFNOSUPPORT, in case this jail does not allow IPv4.
2984  * doesn't allow IPv4.  Address passed in in NBO and returned in NBO.
3034  * Returns 0 on success, EAFNOSUPPORT if the jail doesn't allow IPv4.
3076  * doesn't allow IPv4.  Address passed in in NBO.
3226  * Returns 0 on success, EAFNOSUPPORT if the jail doesn't allow IPv6.
3259  * Return EAFNOSUPPORT, in case this jail does not allow IPv6.
3322  * doesn't allow IPv6.
3371  * Returns 0 on success, EAFNOSUPPORT if the jail doesn't allow IPv6.
3412  * doesn't allow IPv6.
3534  * the jail doesn't allow the address family.  IPv4 Address passed in in NBO.
3952 		 * Jail implements visibility constraints already, so allow
3960 		 * allow jailed root various debugging privileges.
3991 		 * Jail implements its own inter-process limits, so allow
4045 		 * Depending on the global setting, allow privilege of
4055 		 * Depending on the global setting, allow privilege of
4083 		 * Conditionally allow creating raw sockets in jail.
4093 		 * sysctls, allow getcred.  This allows identd to work in
4326 	int allow, error, i;
4329 	allow = (pr == &prison0) ? jail_default_allow : pr->pr_allow;
4332 	i = (allow & arg2) ? 1 : 0;
4540 SYSCTL_JAIL_PARAM_NODE(allow, "Jail permission flags");
4554 SYSCTL_JAIL_PARAM_SUBNODE(allow, mount, "Jail mount/unmount permission flags");
4797 	db_printf(" allow           = 0x%x", pr->pr_allow);