From nobody Fri Aug 28 16:00:48 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hWjm61h23z6qdPB for ; Fri, 28 Aug 2026 16:00:54 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hWjm60nLXz3gSZ for ; Fri, 28 Aug 2026 16:00:54 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787932854; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=dJszfPLaqRFjuqArBCe7Owt4QoTEQUwOf4yRLZQJjmU=; b=ebfH7JJGr0H/UaCWrHnX5yA3U58IvWrl9ag8jul3uZnFZ0F9ISnX8/nLOoGbL4+ndS/356 ypYaEQ5fOTcGifMFCkbgJJccos4ZXKmtPMMXkZNhBAE1QWC2+iTfmaQmZ5oMrv98uTcl7G /e6Kwvguml7DeY8lihE1mL7dRXU0fUAZe1+9YpI7MdTAydHyE28uvKtzbi/MQmqYlHsiBr JHc/LYBAXIkDM931ilo8jj0jb7g8t5FMvGaeXJ7PagKgWRJ4SpmMcWkVNdy5oylV72i+TO 6ifseXvPi2oNbJRNM5tOr0agkE74QpeUU7WqdVL0BmEAi/0bAOfiotj5lTFBNQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1787932854; a=rsa-sha256; cv=none; b=TBmwRgqJJvBR66bipGMSmVGdaCJAzt+bAOKgYWeRygwpIiZS9j8At6KdvOZsSddIxW8i8t UBfGAoGKXxMzwHUDhLXqR4dTUSdrjNTzgXIwPjmTMzvmt9121aw9ANLBXoN98PT9pnl3IZ B5NqyMqKSKO6aEyBL3CLuXaOLMPG5wNLGm9nJOThpTNKYmnb6TC+O8e0lNtjqpX70z4NtZ kWw0BIIhazxPzXt0iGOat1nTBSEVLIiC+gLC2XM14HFPqL7peIy3Mu8ObLVEcscGq4VLoP JyCkVesolq6zpvtq8sW3kl1h+qKl48T3i6zwJlZXIIw0sxc5tUm11xbXwiODdA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787932854; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=dJszfPLaqRFjuqArBCe7Owt4QoTEQUwOf4yRLZQJjmU=; b=pmWfSuzBpz2cFksqh5ROPo7W5N2b7yeerwSA5sDeK3s3TX5YbTasW5fpQ+5ouqghrVN4S8 rkEUXLGq7Z5JhTyrvR37Go8pwg9HonSCm3D+2oXpdUvC+fio5s5rzvGI7wcMxG/vqszePe Vte4abnYz/0RKiBrrAM5stUjkl7XNijpSz9zCmb8pNsgwnIy6zMSxu7dVk71qZuFayp6Vh WsykEZYwtNCn9ZY9oFXJF9UiwtKHGtsNYotPRQ0jLOVYeB6J2ZlY+RrxHemhWxZn5ykM+b +snNbJFRaXRaIhdzD0f+ndW6Mw/SfW6S9k3yA6sJqjXWFJlpP3YUbnSdeRaxpA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hWjm56cbCz1G90 for ; Fri, 28 Aug 2026 16:00:53 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 455a9 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 28 Aug 2026 16:00:48 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: =?utf-8?Q?Jes=C3=BAs?= Daniel Colmenares Oviedo Subject: git: 1853976b7522 - stable/15 - nullfs: Allow VSOCK to be mounted on top of another VSOCK List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: dtxdf X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 1853976b752229b0a93b21a6bcc7691d177bceb3 Auto-Submitted: auto-generated Date: Fri, 28 Aug 2026 16:00:48 +0000 Message-Id: <6a91b0b0.455a9.22db3426@gitrepo.freebsd.org> The branch stable/15 has been updated by dtxdf: URL: https://cgit.FreeBSD.org/src/commit/?id=1853976b752229b0a93b21a6bcc7691d177bceb3 commit 1853976b752229b0a93b21a6bcc7691d177bceb3 Author: Jesús Daniel Colmenares Oviedo AuthorDate: 2026-08-28 05:12:46 +0000 Commit: Jesús Daniel Colmenares Oviedo CommitDate: 2026-08-28 15:59:56 +0000 nullfs: Allow VSOCK to be mounted on top of another VSOCK In the world of containers, mounting a unix(4) socket is a common practice to allow communication between processes within containers. For example, both Podman and Docker can expose a unix(4) socket, and that same unix(4) socket can be mounted as a file accessible to a process inside a container, allowing that application to control Podman or Docker. Another example is PHP-FPM with NGINX, where, instead of using TCP/IP for communication between containers, a unix(4) socket is sufficient. However, nullfs(4) and all related components do not allow mounting a VSOCK on top of another. The current workaround involves creating the socket in a directory and mounting that directory. This is an option, though it does not provide a good user experience compared to directly mounting a VSOCK on top of another, since the application that creates the socket may create other sockets in that directory, and the user may not wish to share them, or, worse yet, applications that create unix(4) sockets may not provide any authentication at all, as they may assume that security at the file system level is sufficient. Reviewed by: dfr@ Approved by: dfr@ Relnotes: yes Differential Revision: https://reviews.freebsd.org/D59158 (cherry picked from commit 2c68ad49f13ddfa33735bd9bb6a3ca170a472ac0) --- lib/libutil/mntopts.c | 2 +- sbin/mount_nullfs/mount_nullfs.8 | 6 ++++-- sbin/mount_nullfs/mount_nullfs.c | 6 +++--- sys/fs/nullfs/null_vfsops.c | 2 +- sys/kern/vfs_cache.c | 6 +++--- sys/kern/vfs_mount.c | 6 +++--- 6 files changed, 15 insertions(+), 13 deletions(-) diff --git a/lib/libutil/mntopts.c b/lib/libutil/mntopts.c index 4a064a086fd5..0412007ebcdf 100644 --- a/lib/libutil/mntopts.c +++ b/lib/libutil/mntopts.c @@ -138,7 +138,7 @@ checkpath_allow_file(const char *path, char *resolved) if (realpath(path, resolved) == NULL || stat(resolved, &sb) != 0) return (1); - if (!S_ISDIR(sb.st_mode) && !S_ISREG(sb.st_mode)) { + if (!S_ISDIR(sb.st_mode) && !S_ISREG(sb.st_mode) && !S_ISSOCK(sb.st_mode)) { errno = ENOTDIR; return (1); } diff --git a/sbin/mount_nullfs/mount_nullfs.8 b/sbin/mount_nullfs/mount_nullfs.8 index b3cf57fd9dea..2ea14dca2259 100644 --- a/sbin/mount_nullfs/mount_nullfs.8 +++ b/sbin/mount_nullfs/mount_nullfs.8 @@ -30,7 +30,7 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd March 24, 2024 +.Dd August 24, 2026 .Dt MOUNT_NULLFS 8 .Os .Sh NAME @@ -62,7 +62,9 @@ but in other respects it is indistinguishable from the original. .Pp The .Nm -utility supports mounting both directories and single files. +utility supports mounting directories, regular files and +.Xr unix 4 +sockets. Both .Ar target and diff --git a/sbin/mount_nullfs/mount_nullfs.c b/sbin/mount_nullfs/mount_nullfs.c index fc04961e6247..d1096bd1bad3 100644 --- a/sbin/mount_nullfs/mount_nullfs.c +++ b/sbin/mount_nullfs/mount_nullfs.c @@ -98,13 +98,13 @@ main(int argc, char *argv[]) err(EX_USAGE, "%s", target); if (stat_realpath(argv[1], mountpoint, &mountpoint_stat) != 0) err(EX_USAGE, "%s", mountpoint); - if (!S_ISDIR(target_stat.st_mode) && !S_ISREG(target_stat.st_mode)) - errx(EX_USAGE, "%s: must be either a file or directory", + if (!S_ISDIR(target_stat.st_mode) && !S_ISREG(target_stat.st_mode) && !S_ISSOCK(target_stat.st_mode)) + errx(EX_USAGE, "%s: must be either a file, a socket or a directory", target); if ((target_stat.st_mode & S_IFMT) != (mountpoint_stat.st_mode & S_IFMT)) errx(EX_USAGE, - "%s: must be same type as %s (file or directory)", + "%s: must be same type as %s (file, socket or directory)", mountpoint, target); build_iovec(&iov, &iovlen, "fstype", nullfs, (size_t)-1); diff --git a/sys/fs/nullfs/null_vfsops.c b/sys/fs/nullfs/null_vfsops.c index 0ec4f9c87297..b3fd266c7fe0 100644 --- a/sys/fs/nullfs/null_vfsops.c +++ b/sys/fs/nullfs/null_vfsops.c @@ -175,7 +175,7 @@ nullfs_mount(struct mount *mp) * Lower vnode must be the same type as the covered vnode - we * don't allow mounting directories to files or vice versa. */ - if ((lowerrootvp->v_type != VDIR && lowerrootvp->v_type != VREG) || + if ((lowerrootvp->v_type != VDIR && lowerrootvp->v_type != VREG && lowerrootvp->v_type != VSOCK) || lowerrootvp->v_type != mp->mnt_vnodecovered->v_type) { NULLFSDEBUG("nullfs_mount: target must be same type as fspath"); vput(lowerrootvp); diff --git a/sys/kern/vfs_cache.c b/sys/kern/vfs_cache.c index 822c2e19ad04..524fc51421d3 100644 --- a/sys/kern/vfs_cache.c +++ b/sys/kern/vfs_cache.c @@ -3268,7 +3268,7 @@ kern___realpathat(struct thread *td, int fd, const char *path, char *buf, if ((error = namei(&nd)) != 0) return (error); - if (nd.ni_vp->v_type == VREG && nd.ni_dvp->v_type != VDIR && + if ((nd.ni_vp->v_type == VREG || nd.ni_vp->v_type == VSOCK) && nd.ni_dvp->v_type != VDIR && (nd.ni_vp->v_vflag & VV_ROOT) != 0) { struct vnode *covered_vp; @@ -5705,7 +5705,7 @@ cache_fplookup_climb_mount(struct cache_fpl *fpl) vp = fpl->tvp; vp_seqc = fpl->tvp_seqc; - VNPASS(vp->v_type == VDIR || vp->v_type == VREG || vp->v_type == VBAD, vp); + VNPASS(vp->v_type == VDIR || vp->v_type == VREG || vp->v_type == VSOCK || vp->v_type == VBAD, vp); mp = atomic_load_ptr(&vp->v_mountedhere); if (__predict_false(mp == NULL)) { return (0); @@ -5762,7 +5762,7 @@ cache_fplookup_cross_mount(struct cache_fpl *fpl) vp = fpl->tvp; vp_seqc = fpl->tvp_seqc; - VNPASS(vp->v_type == VDIR || vp->v_type == VREG || vp->v_type == VBAD, vp); + VNPASS(vp->v_type == VDIR || vp->v_type == VREG || vp->v_type == VSOCK || vp->v_type == VBAD, vp); mp = atomic_load_ptr(&vp->v_mountedhere); if (__predict_false(mp == NULL)) { return (0); diff --git a/sys/kern/vfs_mount.c b/sys/kern/vfs_mount.c index 82bba3f2ee61..77119e5ed655 100644 --- a/sys/kern/vfs_mount.c +++ b/sys/kern/vfs_mount.c @@ -1155,12 +1155,12 @@ vfs_domount_first( if (error == 0) error = vinvalbuf(vp, V_SAVE, 0, 0); if (vfsp->vfc_flags & VFCF_FILEMOUNT) { - if (error == 0 && vp->v_type != VDIR && vp->v_type != VREG) + if (error == 0 && vp->v_type != VDIR && vp->v_type != VREG && vp->v_type != VSOCK) error = EINVAL; /* * For file mounts, ensure that there is only one hardlink to the file. */ - if (error == 0 && vp->v_type == VREG && va.va_nlink != 1) + if (error == 0 && (vp->v_type == VREG || vp->v_type == VSOCK) && va.va_nlink != 1) error = EINVAL; } else { if (error == 0 && vp->v_type != VDIR) @@ -1678,7 +1678,7 @@ vfs_domount( * Don't allow stacking file mounts to work around problems with the way * that namei sets nd.ni_dvp to vp_crossmp for these. */ - if (vp->v_type == VREG) + if (vp->v_type == VREG || vp->v_type == VSOCK) fsflags |= MNT_NOCOVER; if ((fsflags & MNT_UPDATE) == 0) { if ((vp->v_vflag & VV_ROOT) != 0 &&