mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-22 18:17:09 +00:00
Code Issues Releases Wiki Activity

Update apparmor's handling of rlimits for cpu limit and more natural units

Browse Source 
Allow for rlimit cpu to specified which is now supported by the kernel.

Previously the rlimit units where limited to K, M, G and would fail when
KB, MB, GB where used.  Allow for both, also allow for units on lengths
of time, by specifying "seconds", "minutes", "hours".. or any unique subset
eg. "s", "sec", "m", "min", "h", "hour" ..

NOTE:
This patch does not extend rlimits to be able to handle setting of tasks
that are confined by other profiles.

 Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
John Johansen 2011-08-10 15:53:39 -07:00
parent 4dec6cab65
commit f69822107f
2 changed files with 28 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
parser/parser_lex.l
View File

@ -508,7 +508,7 @@ LT_EQUAL <=
{WS}+ { DUMP_PREPROCESS; /* Eat whitespace */ } {WS}+ { DUMP_PREPROCESS; /* Eat whitespace */ }
-?{NUMBER}[kKMG]? { -?{NUMBER}[[:alpha:]]* {
DUMP_PREPROCESS; DUMP_PREPROCESS;
yylval.var_val = strdup(yytext); yylval.var_val = strdup(yytext);
return TOK_VALUE; return TOK_VALUE;

33
parser/parser_yacc.y
View File

@ -711,10 +711,31 @@ rules: rules TOK_SET TOK_RLIMIT TOK_ID TOK_LE TOK_VALUE TOK_END_OF_RULE
if (strcmp($6, "infinity") == 0) { if (strcmp($6, "infinity") == 0) {
value = RLIM_INFINITY; value = RLIM_INFINITY;
} else { } else {
const char *seconds = "seconds";
const char *minutes = "minutes";
const char *hours = "hours";
const char *days = "days";
const char *kb = "KB";
const char *mb = "MB";
const char *gb = "GB";
tmp = strtoll($6, &end, 0); tmp = strtoll($6, &end, 0);
switch (limit) { switch (limit) {
case RLIMIT_CPU: case RLIMIT_CPU:
yyerror("RLIMIT '%s' is currently unsupported\n", $4); if (!end || $6 == end || tmp < 0)
yyerror("RLIMIT '%s' invalid value %s\n", $4, $6);
if (*end == '\0' ||
strstr(seconds, end) == seconds) {
value = tmp;
} else if (strstr(minutes, end) == minutes) {
value = tmp * 60;
} else if (strstr(hours, end) == hours) {
value = tmp * 60 * 60;
} else if (strstr(days, end) == days) {
value = tmp * 60 * 60 * 24;
} else {
yyerror("RLIMIT '%s' invalid value %s\n", $4, $6);
}
break; break;
case RLIMIT_NOFILE: case RLIMIT_NOFILE:
case RLIMIT_NPROC: case RLIMIT_NPROC:
@ -722,14 +743,14 @@ rules: rules TOK_SET TOK_RLIMIT TOK_ID TOK_LE TOK_VALUE TOK_END_OF_RULE
case RLIMIT_SIGPENDING: case RLIMIT_SIGPENDING:
#ifdef RLIMIT_RTPRIO #ifdef RLIMIT_RTPRIO
case RLIMIT_RTPRIO: case RLIMIT_RTPRIO:
if ($6 == end || *end != '\0' || tmp < 0) if (!end || $6 == end || *end != '\0' || tmp < 0)
yyerror("RLIMIT '%s' invalid value %s\n", $4, $6); yyerror("RLIMIT '%s' invalid value %s\n", $4, $6);
value = tmp; value = tmp;
break; break;
#endif #endif
#ifdef RLIMIT_NICE #ifdef RLIMIT_NICE
case RLIMIT_NICE: case RLIMIT_NICE:
if ($6 == end || *end != '\0') if (!end || $6 == end || *end != '\0')
yyerror("RLIMIT '%s' invalid value %s\n", $4, $6); yyerror("RLIMIT '%s' invalid value %s\n", $4, $6);
if (tmp < -20 || tmp > 19) if (tmp < -20 || tmp > 19)
yyerror("RLIMIT '%s' out of range (-20 .. 19) %d\n", $4, tmp); yyerror("RLIMIT '%s' out of range (-20 .. 19) %d\n", $4, tmp);
@ -746,11 +767,11 @@ rules: rules TOK_SET TOK_RLIMIT TOK_ID TOK_LE TOK_VALUE TOK_END_OF_RULE
case RLIMIT_MSGQUEUE: case RLIMIT_MSGQUEUE:
if ($6 == end || tmp < 0) if ($6 == end || tmp < 0)
yyerror("RLIMIT '%s' invalid value %s\n", $4, $6); yyerror("RLIMIT '%s' invalid value %s\n", $4, $6);
if (strcmp(end, "K") == 0) { if (strstr(kb, end) == kb) {
tmp *= 1024; tmp *= 1024;
} else if (strcmp(end, "M") == 0) { } else if (strstr(mb, end) == mb) {
tmp *= 1024*1024; tmp *= 1024*1024;
} else if (strcmp(end, "G") == 0) { } else if (strstr(gb, end) == gb) {
tmp *= 1024*1024*1024; tmp *= 1024*1024*1024;
} else if (*end != '\0') { } else if (*end != '\0') {
yyerror("RLIMIT '%s' invalid value %s\n", $4, $6); yyerror("RLIMIT '%s' invalid value %s\n", $4, $6);