From nobody Fri Aug 28 05:19:27 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hWRX43TdMz6q8y5 for ; Fri, 28 Aug 2026 05:19:32 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hWRX42Tdsz3cdP for ; Fri, 28 Aug 2026 05:19:32 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787894372; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=kdU/8i6RN9+xnocgZBpJI4o1PdOEd1ZJ5x0vQ3KCylE=; b=ANGcpGYhjDYScjYh9LV9AIMZijLpMS/wfwAWYMvo2dFHpWAYFKwPyLZHd/J0Ghh4RvEpnD k3EQ8dA/H/DvmHqMjl/6h5wGc+WWZ0Wgy9VMglkErrM0KUkPNTRfomHMAzh0MtikQeYsiv ADjWwpMvAP9yXm1yCNFbjBmNLXEot2DMqPNTTbzxfcxNRzOe1mprQEmy7yZbYst+0bD9FF BuXGONMdHkOkndNEJDXj2ZX490/GumwpOle9Vx8rE8bQEOJFJMbrBN8qzsrjNWQuqwEz6K h024ghpgCkm3hR21hwrKNwAK7abxdaLv2mW6BMSnC3Cdb3TzeNjdIFGA/vWTOg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1787894372; a=rsa-sha256; cv=none; b=sofJvpEs8ClCSLPlS6g1KB5EVJDu5bXly7MsrxAWTpfd8q1fx4D4eNO8Qz7dOAZsI5ewoS 8Q+//406GtCbdyJho9+BrS3gQTZ8fBF24dTw0lDED/lESibV7FBQDADVVgL0gUwwbaT+w0 BSKW1XSwu5VKwZprA3O6Cky4V8ABAjRLl6i4LpVICeoLouh9K7mJ+NtoVQBbuefkhHkQDr vE+f5szwEJ5He3IQn+np5RQySFSbzU2KdmIe+wNlmrcyCCYrTxdFL4otY5lgUsK617ZXey UG7/7cLOGURuTTIPAXyvd4RDt8BZiIml11o7f1MhCQiEf+CNse43LkM/cotWjg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787894372; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=kdU/8i6RN9+xnocgZBpJI4o1PdOEd1ZJ5x0vQ3KCylE=; b=q8tA2r0oaxm2HOvwBQXuImRqd/A6Zr3N6DaY6+dVUk6ahZbW4vwGCQuu0R+JpwD8Mw6mXc yffYuXlM6Ce/FZl0k31hfQvFPwzSKJnPf8kiL5spP3J1KoXy0hur671rxk1nBrPEqwsFPb xB6Ksvcj8rWMI020I0C4kY9zfh87oVI2qdhjRipcWIMG6qEl8IPs2JiORRX5roJ+LDxZI1 Y+zSi9CoGpYboabc0/ldDT/jHf2b0zYFgLy76WLXLgP1t03wyYxLYszDweePI35A9Hi6ko onDTs6sPkLp27S1x8kVPZVd/4g1rAfucjEEChf/9mWU4XnsJVMK8OWuLdc28cA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hWRX41M2fzwv9 for ; Fri, 28 Aug 2026 05:19:32 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 4726f by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 28 Aug 2026 05:19:27 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: =?utf-8?Q?Jes=C3=BAs?= Daniel Colmenares Oviedo Subject: git: 2c68ad49f13d - main - nullfs: Allow VSOCK to be mounted on top of another VSOCK List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: dtxdf X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 2c68ad49f13ddfa33735bd9bb6a3ca170a472ac0 Auto-Submitted: auto-generated Date: Fri, 28 Aug 2026 05:19:27 +0000 Message-Id: <6a911a5f.4726f.3083268c@gitrepo.freebsd.org> The branch main has been updated by dtxdf: URL: https://cgit.FreeBSD.org/src/commit/?id=2c68ad49f13ddfa33735bd9bb6a3ca170a472ac0 commit 2c68ad49f13ddfa33735bd9bb6a3ca170a472ac0 Author: Jesús Daniel Colmenares Oviedo AuthorDate: 2026-08-28 05:12:46 +0000 Commit: Jesús Daniel Colmenares Oviedo CommitDate: 2026-08-28 05:12:46 +0000 nullfs: Allow VSOCK to be mounted on top of another VSOCK In the world of containers, mounting a unix(4) socket is a common practice to allow communication between processes within containers. For example, both Podman and Docker can expose a unix(4) socket, and that same unix(4) socket can be mounted as a file accessible to a process inside a container, allowing that application to control Podman or Docker. Another example is PHP-FPM with NGINX, where, instead of using TCP/IP for communication between containers, a unix(4) socket is sufficient. However, nullfs(4) and all related components do not allow mounting a VSOCK on top of another. The current workaround involves creating the socket in a directory and mounting that directory. This is an option, though it does not provide a good user experience compared to directly mounting a VSOCK on top of another, since the application that creates the socket may create other sockets in that directory, and the user may not wish to share them, or, worse yet, applications that create unix(4) sockets may not provide any authentication at all, as they may assume that security at the file system level is sufficient. Reviewed by: dfr@ Approved by: dfr@ Relnotes: yes Differential Revision: https://reviews.freebsd.org/D59158 --- lib/libutil/mntopts.c | 2 +- sbin/mount_nullfs/mount_nullfs.8 | 6 ++++-- sbin/mount_nullfs/mount_nullfs.c | 6 +++--- sys/fs/nullfs/null_vfsops.c | 2 +- sys/kern/vfs_cache.c | 6 +++--- sys/kern/vfs_mount.c | 6 +++--- 6 files changed, 15 insertions(+), 13 deletions(-) diff --git a/lib/libutil/mntopts.c b/lib/libutil/mntopts.c index 4a064a086fd5..0412007ebcdf 100644 --- a/lib/libutil/mntopts.c +++ b/lib/libutil/mntopts.c @@ -138,7 +138,7 @@ checkpath_allow_file(const char *path, char *resolved) if (realpath(path, resolved) == NULL || stat(resolved, &sb) != 0) return (1); - if (!S_ISDIR(sb.st_mode) && !S_ISREG(sb.st_mode)) { + if (!S_ISDIR(sb.st_mode) && !S_ISREG(sb.st_mode) && !S_ISSOCK(sb.st_mode)) { errno = ENOTDIR; return (1); } diff --git a/sbin/mount_nullfs/mount_nullfs.8 b/sbin/mount_nullfs/mount_nullfs.8 index b3cf57fd9dea..2ea14dca2259 100644 --- a/sbin/mount_nullfs/mount_nullfs.8 +++ b/sbin/mount_nullfs/mount_nullfs.8 @@ -30,7 +30,7 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd March 24, 2024 +.Dd August 24, 2026 .Dt MOUNT_NULLFS 8 .Os .Sh NAME @@ -62,7 +62,9 @@ but in other respects it is indistinguishable from the original. .Pp The .Nm -utility supports mounting both directories and single files. +utility supports mounting directories, regular files and +.Xr unix 4 +sockets. Both .Ar target and diff --git a/sbin/mount_nullfs/mount_nullfs.c b/sbin/mount_nullfs/mount_nullfs.c index fc04961e6247..d1096bd1bad3 100644 --- a/sbin/mount_nullfs/mount_nullfs.c +++ b/sbin/mount_nullfs/mount_nullfs.c @@ -98,13 +98,13 @@ main(int argc, char *argv[]) err(EX_USAGE, "%s", target); if (stat_realpath(argv[1], mountpoint, &mountpoint_stat) != 0) err(EX_USAGE, "%s", mountpoint); - if (!S_ISDIR(target_stat.st_mode) && !S_ISREG(target_stat.st_mode)) - errx(EX_USAGE, "%s: must be either a file or directory", + if (!S_ISDIR(target_stat.st_mode) && !S_ISREG(target_stat.st_mode) && !S_ISSOCK(target_stat.st_mode)) + errx(EX_USAGE, "%s: must be either a file, a socket or a directory", target); if ((target_stat.st_mode & S_IFMT) != (mountpoint_stat.st_mode & S_IFMT)) errx(EX_USAGE, - "%s: must be same type as %s (file or directory)", + "%s: must be same type as %s (file, socket or directory)", mountpoint, target); build_iovec(&iov, &iovlen, "fstype", nullfs, (size_t)-1); diff --git a/sys/fs/nullfs/null_vfsops.c b/sys/fs/nullfs/null_vfsops.c index 0ec4f9c87297..b3fd266c7fe0 100644 --- a/sys/fs/nullfs/null_vfsops.c +++ b/sys/fs/nullfs/null_vfsops.c @@ -175,7 +175,7 @@ nullfs_mount(struct mount *mp) * Lower vnode must be the same type as the covered vnode - we * don't allow mounting directories to files or vice versa. */ - if ((lowerrootvp->v_type != VDIR && lowerrootvp->v_type != VREG) || + if ((lowerrootvp->v_type != VDIR && lowerrootvp->v_type != VREG && lowerrootvp->v_type != VSOCK) || lowerrootvp->v_type != mp->mnt_vnodecovered->v_type) { NULLFSDEBUG("nullfs_mount: target must be same type as fspath"); vput(lowerrootvp); diff --git a/sys/kern/vfs_cache.c b/sys/kern/vfs_cache.c index 9e1c9cb757b5..6692ae6facf9 100644 --- a/sys/kern/vfs_cache.c +++ b/sys/kern/vfs_cache.c @@ -3292,7 +3292,7 @@ kern___realpathat(struct thread *td, int fd, const char *path, char *buf, if ((error = namei(&nd)) != 0) return (error); - if (nd.ni_vp->v_type == VREG && nd.ni_dvp->v_type != VDIR && + if ((nd.ni_vp->v_type == VREG || nd.ni_vp->v_type == VSOCK) && nd.ni_dvp->v_type != VDIR && (nd.ni_vp->v_vflag & VV_ROOT) != 0) { struct vnode *covered_vp; @@ -5729,7 +5729,7 @@ cache_fplookup_climb_mount(struct cache_fpl *fpl) vp = fpl->tvp; vp_seqc = fpl->tvp_seqc; - VNPASS(vp->v_type == VDIR || vp->v_type == VREG || vp->v_type == VBAD, vp); + VNPASS(vp->v_type == VDIR || vp->v_type == VREG || vp->v_type == VSOCK || vp->v_type == VBAD, vp); mp = atomic_load_ptr(&vp->v_mountedhere); if (__predict_false(mp == NULL)) { return (0); @@ -5786,7 +5786,7 @@ cache_fplookup_cross_mount(struct cache_fpl *fpl) vp = fpl->tvp; vp_seqc = fpl->tvp_seqc; - VNPASS(vp->v_type == VDIR || vp->v_type == VREG || vp->v_type == VBAD, vp); + VNPASS(vp->v_type == VDIR || vp->v_type == VREG || vp->v_type == VSOCK || vp->v_type == VBAD, vp); mp = atomic_load_ptr(&vp->v_mountedhere); if (__predict_false(mp == NULL)) { return (0); diff --git a/sys/kern/vfs_mount.c b/sys/kern/vfs_mount.c index 94720615bc3f..265e95ee0a75 100644 --- a/sys/kern/vfs_mount.c +++ b/sys/kern/vfs_mount.c @@ -1171,12 +1171,12 @@ vfs_domount_first( if (error == 0) error = vinvalbuf(vp, V_SAVE, 0, 0); if (vfsp->vfc_flags & VFCF_FILEMOUNT) { - if (error == 0 && vp->v_type != VDIR && vp->v_type != VREG) + if (error == 0 && vp->v_type != VDIR && vp->v_type != VREG && vp->v_type != VSOCK) error = EINVAL; /* * For file mounts, ensure that there is only one hardlink to the file. */ - if (error == 0 && vp->v_type == VREG && va.va_nlink != 1) + if (error == 0 && (vp->v_type == VREG || vp->v_type == VSOCK) && va.va_nlink != 1) error = EINVAL; } else { if (error == 0 && vp->v_type != VDIR) @@ -1700,7 +1700,7 @@ vfs_domount( * Don't allow stacking file mounts to work around problems with the way * that namei sets nd.ni_dvp to vp_crossmp for these. */ - if (vp->v_type == VREG) + if (vp->v_type == VREG || vp->v_type == VSOCK) fsflags |= MNT_NOCOVER; if ((fsflags & MNT_UPDATE) == 0) { if ((vp->v_vflag & VV_ROOT) != 0 &&