From nobody Fri Aug 28 16:00:48 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hWjm11YSXz6qcyj for ; Fri, 28 Aug 2026 16:00:49 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hWjm10TDYz3g3Q for ; Fri, 28 Aug 2026 16:00:49 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787932849; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=dJszfPLaqRFjuqArBCe7Owt4QoTEQUwOf4yRLZQJjmU=; b=XOtPO81WCAmZtlNEoBn8d5m66DfzUzgGaEZ0fQgL9S43c3sILQ1c90E5EAV9hJMp64hvi+ GuIOPq/hSo/5Lo/js/8IhpBmmtRJMqFS6hficci7PlU4mJnyElqYDLVat6KDjx0i81AE3f 73kjBJRHyeUCsZjvL2DeJxoMcRqa63v5WmOXRua+wG6KytdGJ9FaqkoI4aRPUPcr2D8kxf QLZI5Y0kGp5Yvlzo7VoXDfH0GUlWoO3zJYkfeaCDeGOQojM7PgCtZC9s2VjAy3IV96ouCH 3qeygG1f3arNe8L5IRWHrp/fOOmt9ABHBfmLuQ2UbokE4IM7tbVwH/cKeKbBQA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1787932849; a=rsa-sha256; cv=none; b=I7vRV4nqfk7X7OGIKsJ50R6lY8aqi9Yz3c/XmiJrG/4pymK8XZQYtPJzUulj0qvOKa5PAb mwk5FXNJ59hH7cQ49zSlQk2iZ0w01kRUmFlZ9e0dcq9+ki1hGaLHixT4Q/nsxCUSB/7WAT FRLuQhK2iiNgDdExRqc41qpCNO7f79NR4p79gWwDGt8Qagr3Wy3jQHc6b+NUV0cGB6ZD3j 3X+ERcpMFAIsC+Wft1jw4ojcOOV6H+I1JynM2XgHmZUoEM7ZoEcMR3DDDsLVEI32cnMr5l XkyRAqLVwGzKEy7BR6MEAHN4UktVzKoVBTf66nzWeweKkdB/+JztzqTz+LX0OA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787932849; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=dJszfPLaqRFjuqArBCe7Owt4QoTEQUwOf4yRLZQJjmU=; b=Qc0YTzS70HutRx+3qJ+q4RgPwn22SQPzFuiymYBTzCf2iuYH8i7Z5ZUHMvjBnzl1NKlPL1 VLKll1/1vrTPkNEnL8nQA7vfAC+l7QtQzW9X0HkBoUbffMoGm+hiTuGlNqk/PnxphRrUGo cuA+dRQIYyIGAkOWSttKm1cCcaopwFQb7JZj7AgyAQ6/fmK1tFoRQT/qqiNsilOhd/Zj/J 9wRsrBGKntYafx4G52L90Gq7uwypfrBYluIgs3fIHEilkGUoaJaa3d3HsUXzW8b5h7XfzT TZKwHBt1pIShF/fi6hwT36eYyi7E2OaBgF+a9syTLQFdcIgeXXPptbspPpsbDg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hWjm06PdLz1Fqm for ; Fri, 28 Aug 2026 16:00:48 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 455a9 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 28 Aug 2026 16:00:48 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: =?utf-8?Q?Jes=C3=BAs?= Daniel Colmenares Oviedo Subject: git: 1853976b7522 - stable/15 - nullfs: Allow VSOCK to be mounted on top of another VSOCK List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: dtxdf X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 1853976b752229b0a93b21a6bcc7691d177bceb3 Auto-Submitted: auto-generated Date: Fri, 28 Aug 2026 16:00:48 +0000 Message-Id: <6a91b0b0.455a9.22db3426@gitrepo.freebsd.org> The branch stable/15 has been updated by dtxdf: URL: https://cgit.FreeBSD.org/src/commit/?id=1853976b752229b0a93b21a6bcc7691d177bceb3 commit 1853976b752229b0a93b21a6bcc7691d177bceb3 Author: Jesús Daniel Colmenares Oviedo AuthorDate: 2026-08-28 05:12:46 +0000 Commit: Jesús Daniel Colmenares Oviedo CommitDate: 2026-08-28 15:59:56 +0000 nullfs: Allow VSOCK to be mounted on top of another VSOCK In the world of containers, mounting a unix(4) socket is a common practice to allow communication between processes within containers. For example, both Podman and Docker can expose a unix(4) socket, and that same unix(4) socket can be mounted as a file accessible to a process inside a container, allowing that application to control Podman or Docker. Another example is PHP-FPM with NGINX, where, instead of using TCP/IP for communication between containers, a unix(4) socket is sufficient. However, nullfs(4) and all related components do not allow mounting a VSOCK on top of another. The current workaround involves creating the socket in a directory and mounting that directory. This is an option, though it does not provide a good user experience compared to directly mounting a VSOCK on top of another, since the application that creates the socket may create other sockets in that directory, and the user may not wish to share them, or, worse yet, applications that create unix(4) sockets may not provide any authentication at all, as they may assume that security at the file system level is sufficient. Reviewed by: dfr@ Approved by: dfr@ Relnotes: yes Differential Revision: https://reviews.freebsd.org/D59158 (cherry picked from commit 2c68ad49f13ddfa33735bd9bb6a3ca170a472ac0) --- lib/libutil/mntopts.c | 2 +- sbin/mount_nullfs/mount_nullfs.8 | 6 ++++-- sbin/mount_nullfs/mount_nullfs.c | 6 +++--- sys/fs/nullfs/null_vfsops.c | 2 +- sys/kern/vfs_cache.c | 6 +++--- sys/kern/vfs_mount.c | 6 +++--- 6 files changed, 15 insertions(+), 13 deletions(-) diff --git a/lib/libutil/mntopts.c b/lib/libutil/mntopts.c index 4a064a086fd5..0412007ebcdf 100644 --- a/lib/libutil/mntopts.c +++ b/lib/libutil/mntopts.c @@ -138,7 +138,7 @@ checkpath_allow_file(const char *path, char *resolved) if (realpath(path, resolved) == NULL || stat(resolved, &sb) != 0) return (1); - if (!S_ISDIR(sb.st_mode) && !S_ISREG(sb.st_mode)) { + if (!S_ISDIR(sb.st_mode) && !S_ISREG(sb.st_mode) && !S_ISSOCK(sb.st_mode)) { errno = ENOTDIR; return (1); } diff --git a/sbin/mount_nullfs/mount_nullfs.8 b/sbin/mount_nullfs/mount_nullfs.8 index b3cf57fd9dea..2ea14dca2259 100644 --- a/sbin/mount_nullfs/mount_nullfs.8 +++ b/sbin/mount_nullfs/mount_nullfs.8 @@ -30,7 +30,7 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd March 24, 2024 +.Dd August 24, 2026 .Dt MOUNT_NULLFS 8 .Os .Sh NAME @@ -62,7 +62,9 @@ but in other respects it is indistinguishable from the original. .Pp The .Nm -utility supports mounting both directories and single files. +utility supports mounting directories, regular files and +.Xr unix 4 +sockets. Both .Ar target and diff --git a/sbin/mount_nullfs/mount_nullfs.c b/sbin/mount_nullfs/mount_nullfs.c index fc04961e6247..d1096bd1bad3 100644 --- a/sbin/mount_nullfs/mount_nullfs.c +++ b/sbin/mount_nullfs/mount_nullfs.c @@ -98,13 +98,13 @@ main(int argc, char *argv[]) err(EX_USAGE, "%s", target); if (stat_realpath(argv[1], mountpoint, &mountpoint_stat) != 0) err(EX_USAGE, "%s", mountpoint); - if (!S_ISDIR(target_stat.st_mode) && !S_ISREG(target_stat.st_mode)) - errx(EX_USAGE, "%s: must be either a file or directory", + if (!S_ISDIR(target_stat.st_mode) && !S_ISREG(target_stat.st_mode) && !S_ISSOCK(target_stat.st_mode)) + errx(EX_USAGE, "%s: must be either a file, a socket or a directory", target); if ((target_stat.st_mode & S_IFMT) != (mountpoint_stat.st_mode & S_IFMT)) errx(EX_USAGE, - "%s: must be same type as %s (file or directory)", + "%s: must be same type as %s (file, socket or directory)", mountpoint, target); build_iovec(&iov, &iovlen, "fstype", nullfs, (size_t)-1); diff --git a/sys/fs/nullfs/null_vfsops.c b/sys/fs/nullfs/null_vfsops.c index 0ec4f9c87297..b3fd266c7fe0 100644 --- a/sys/fs/nullfs/null_vfsops.c +++ b/sys/fs/nullfs/null_vfsops.c @@ -175,7 +175,7 @@ nullfs_mount(struct mount *mp) * Lower vnode must be the same type as the covered vnode - we * don't allow mounting directories to files or vice versa. */ - if ((lowerrootvp->v_type != VDIR && lowerrootvp->v_type != VREG) || + if ((lowerrootvp->v_type != VDIR && lowerrootvp->v_type != VREG && lowerrootvp->v_type != VSOCK) || lowerrootvp->v_type != mp->mnt_vnodecovered->v_type) { NULLFSDEBUG("nullfs_mount: target must be same type as fspath"); vput(lowerrootvp); diff --git a/sys/kern/vfs_cache.c b/sys/kern/vfs_cache.c index 822c2e19ad04..524fc51421d3 100644 --- a/sys/kern/vfs_cache.c +++ b/sys/kern/vfs_cache.c @@ -3268,7 +3268,7 @@ kern___realpathat(struct thread *td, int fd, const char *path, char *buf, if ((error = namei(&nd)) != 0) return (error); - if (nd.ni_vp->v_type == VREG && nd.ni_dvp->v_type != VDIR && + if ((nd.ni_vp->v_type == VREG || nd.ni_vp->v_type == VSOCK) && nd.ni_dvp->v_type != VDIR && (nd.ni_vp->v_vflag & VV_ROOT) != 0) { struct vnode *covered_vp; @@ -5705,7 +5705,7 @@ cache_fplookup_climb_mount(struct cache_fpl *fpl) vp = fpl->tvp; vp_seqc = fpl->tvp_seqc; - VNPASS(vp->v_type == VDIR || vp->v_type == VREG || vp->v_type == VBAD, vp); + VNPASS(vp->v_type == VDIR || vp->v_type == VREG || vp->v_type == VSOCK || vp->v_type == VBAD, vp); mp = atomic_load_ptr(&vp->v_mountedhere); if (__predict_false(mp == NULL)) { return (0); @@ -5762,7 +5762,7 @@ cache_fplookup_cross_mount(struct cache_fpl *fpl) vp = fpl->tvp; vp_seqc = fpl->tvp_seqc; - VNPASS(vp->v_type == VDIR || vp->v_type == VREG || vp->v_type == VBAD, vp); + VNPASS(vp->v_type == VDIR || vp->v_type == VREG || vp->v_type == VSOCK || vp->v_type == VBAD, vp); mp = atomic_load_ptr(&vp->v_mountedhere); if (__predict_false(mp == NULL)) { return (0); diff --git a/sys/kern/vfs_mount.c b/sys/kern/vfs_mount.c index 82bba3f2ee61..77119e5ed655 100644 --- a/sys/kern/vfs_mount.c +++ b/sys/kern/vfs_mount.c @@ -1155,12 +1155,12 @@ vfs_domount_first( if (error == 0) error = vinvalbuf(vp, V_SAVE, 0, 0); if (vfsp->vfc_flags & VFCF_FILEMOUNT) { - if (error == 0 && vp->v_type != VDIR && vp->v_type != VREG) + if (error == 0 && vp->v_type != VDIR && vp->v_type != VREG && vp->v_type != VSOCK) error = EINVAL; /* * For file mounts, ensure that there is only one hardlink to the file. */ - if (error == 0 && vp->v_type == VREG && va.va_nlink != 1) + if (error == 0 && (vp->v_type == VREG || vp->v_type == VSOCK) && va.va_nlink != 1) error = EINVAL; } else { if (error == 0 && vp->v_type != VDIR) @@ -1678,7 +1678,7 @@ vfs_domount( * Don't allow stacking file mounts to work around problems with the way * that namei sets nd.ni_dvp to vp_crossmp for these. */ - if (vp->v_type == VREG) + if (vp->v_type == VREG || vp->v_type == VSOCK) fsflags |= MNT_NOCOVER; if ((fsflags & MNT_UPDATE) == 0) { if ((vp->v_vflag & VV_ROOT) != 0 &&