Index: usr.sbin/jail/jail.8
===================================================================
--- usr.sbin/jail/jail.8	(revision 232247)
+++ usr.sbin/jail/jail.8	(working copy)
@@ -428,6 +428,14 @@
 and if
 .Va enforce_statfs
 is set to a value lower than 2.
+.It Va allow.mount.procfs
+privileged users inside the jail will be able to mount and unmount the
+procfs file system.
+This permission is effective only together with
+.Va allow.mount
+and if
+.Va enforce_statfs
+is set to a value lower than 2.
 .It Va allow.mount.zfs
 privileged users inside the jail will be able to mount and unmount the
 ZFS file system.
Index: sys/fs/pseudofs/pseudofs.h
===================================================================
--- sys/fs/pseudofs/pseudofs.h	(revision 232247)
+++ sys/fs/pseudofs/pseudofs.h	(working copy)
@@ -31,6 +31,8 @@
 #ifndef _PSEUDOFS_H_INCLUDED
 #define _PSEUDOFS_H_INCLUDED
 
+#include <sys/jail.h>
+
 /*
  * Opaque structures
  */
@@ -271,7 +273,7 @@
 /*
  * Now for some initialization magic...
  */
-#define PSEUDOFS(name, version)						\
+#define PSEUDOFS(name, version, jflag)					\
 									\
 static struct pfs_info name##_info = {					\
 	#name,								\
@@ -281,6 +283,8 @@
 									\
 static int								\
 _##name##_mount(struct mount *mp) {					\
+        if (jflag && !prison_allow(curthread->td_ucred, jflag))		\
+                return (EPERM);						\
 	return pfs_mount(&name##_info, mp);				\
 }									\
 									\
@@ -303,7 +307,7 @@
 	.vfs_uninit =		_##name##_uninit,			\
 	.vfs_unmount =		pfs_unmount,				\
 };									\
-VFS_SET(name##_vfsops, name, VFCF_SYNTHETIC);				\
+VFS_SET(name##_vfsops, name, VFCF_SYNTHETIC | jflag ? VFCF_JAIL : 0);	\
 MODULE_VERSION(name, version);						\
 MODULE_DEPEND(name, pseudofs, 1, 1, 1);
 
Index: sys/fs/procfs/procfs.c
===================================================================
--- sys/fs/procfs/procfs.c	(revision 232247)
+++ sys/fs/procfs/procfs.c	(working copy)
@@ -209,4 +209,4 @@
 	return (0);
 }
 
-PSEUDOFS(procfs, 1);
+PSEUDOFS(procfs, 1, PR_ALLOW_MOUNT_PROCFS);
Index: sys/sys/jail.h
===================================================================
--- sys/sys/jail.h	(revision 232247)
+++ sys/sys/jail.h	(working copy)
@@ -226,7 +226,8 @@
 #define	PR_ALLOW_MOUNT_DEVFS		0x0080
 #define	PR_ALLOW_MOUNT_NULLFS		0x0100
 #define	PR_ALLOW_MOUNT_ZFS		0x0200
-#define	PR_ALLOW_ALL			0x03ff
+#define	PR_ALLOW_MOUNT_PROCFS		0x0400
+#define	PR_ALLOW_ALL			0x07ff
 
 /*
  * OSD methods
Index: sys/kern/kern_jail.c
===================================================================
--- sys/kern/kern_jail.c	(revision 232247)
+++ sys/kern/kern_jail.c	(working copy)
@@ -204,6 +204,7 @@
 	"allow.mount.devfs",
 	"allow.mount.nullfs",
 	"allow.mount.zfs",
+	"allow.mount.procfs",
 };
 const size_t pr_allow_names_size = sizeof(pr_allow_names);
 
@@ -218,6 +219,7 @@
 	"allow.mount.nodevfs",
 	"allow.mount.nonullfs",
 	"allow.mount.nozfs",
+	"allow.mount.noprocfs",
 };
 const size_t pr_allow_nonames_size = sizeof(pr_allow_nonames);
 
@@ -4206,6 +4208,10 @@
     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
     NULL, PR_ALLOW_MOUNT_NULLFS, sysctl_jail_default_allow, "I",
     "Processes in jail can mount the nullfs file system");
+SYSCTL_PROC(_security_jail, OID_AUTO, mount_procfs_allowed,
+    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
+    NULL, PR_ALLOW_MOUNT_PROCFS, sysctl_jail_default_allow, "I",
+    "Processes in jail can mount the procfs file system");
 SYSCTL_PROC(_security_jail, OID_AUTO, mount_zfs_allowed,
     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_MPSAFE,
     NULL, PR_ALLOW_MOUNT_ZFS, sysctl_jail_default_allow, "I",
@@ -4356,6 +4362,8 @@
     "B", "Jail may mount the devfs file system");
 SYSCTL_JAIL_PARAM(_allow_mount, nullfs, CTLTYPE_INT | CTLFLAG_RW,
     "B", "Jail may mount the nullfs file system");
+SYSCTL_JAIL_PARAM(_allow_mount, procfs, CTLTYPE_INT | CTLFLAG_RW,
+    "B", "Jail may mount the procfs file system");
 SYSCTL_JAIL_PARAM(_allow_mount, zfs, CTLTYPE_INT | CTLFLAG_RW,
     "B", "Jail may mount the zfs file system");
 
Index: sys/compat/linprocfs/linprocfs.c
===================================================================
--- sys/compat/linprocfs/linprocfs.c	(revision 232247)
+++ sys/compat/linprocfs/linprocfs.c	(working copy)
@@ -1460,7 +1460,7 @@
 	return (0);
 }
 
-PSEUDOFS(linprocfs, 1);
+PSEUDOFS(linprocfs, 1, 0);
 MODULE_DEPEND(linprocfs, linux, 1, 1, 1);
 MODULE_DEPEND(linprocfs, procfs, 1, 1, 1);
 MODULE_DEPEND(linprocfs, sysvmsg, 1, 1, 1);
Index: sys/compat/linsysfs/linsysfs.c
===================================================================
--- sys/compat/linsysfs/linsysfs.c	(revision 232247)
+++ sys/compat/linsysfs/linsysfs.c	(working copy)
@@ -280,5 +280,5 @@
 	return (0);
 }
 
-PSEUDOFS(linsysfs, 1);
+PSEUDOFS(linsysfs, 1, 0);
 MODULE_DEPEND(linsysfs, linux, 1, 1, 1);