summaryrefslogtreecommitdiffhomepage
path: root/pkg/sentry/limits
diff options
context:
space:
mode:
authorKevin Krakauer <krakauer@google.com>2019-04-10 12:35:43 -0700
committerShentubot <shentubot@google.com>2019-04-10 12:36:45 -0700
commitf7aff0aaa4320505933df838cf5b551b69d5e513 (patch)
treef773a8942f4f025d370ee0d8c0e711944f168f4c /pkg/sentry/limits
parent0a0619216ec9ca96c181dd69d9bf31e7762090cb (diff)
Allow threads with CAP_SYS_RESOURCE to raise hard rlimits.
PiperOrigin-RevId: 242919489 Change-Id: Ie3267b3bcd8a54b54bc16a6556369a19e843376f
Diffstat (limited to 'pkg/sentry/limits')
-rw-r--r--pkg/sentry/limits/limits.go8
-rw-r--r--pkg/sentry/limits/limits_test.go30
-rw-r--r--pkg/sentry/limits/linux.go2
3 files changed, 25 insertions, 15 deletions
diff --git a/pkg/sentry/limits/limits.go b/pkg/sentry/limits/limits.go
index eeca01876..b0571739f 100644
--- a/pkg/sentry/limits/limits.go
+++ b/pkg/sentry/limits/limits.go
@@ -113,13 +113,17 @@ func (l *LimitSet) SetUnchecked(t LimitType, v Limit) {
}
// Set assigns value v to resource of LimitType t and returns the old value.
-func (l *LimitSet) Set(t LimitType, v Limit) (Limit, error) {
+// privileged should be true only when either the caller has CAP_SYS_RESOURCE
+// or when creating limits for a new kernel.
+func (l *LimitSet) Set(t LimitType, v Limit, privileged bool) (Limit, error) {
l.mu.Lock()
defer l.mu.Unlock()
+
// If a limit is already set, make sure the new limit doesn't
// exceed the previous max limit.
if _, ok := l.data[t]; ok {
- if l.data[t].Max < v.Max {
+ // Unprivileged users can only lower their hard limits.
+ if l.data[t].Max < v.Max && !privileged {
return Limit{}, syscall.EPERM
}
if v.Cur > v.Max {
diff --git a/pkg/sentry/limits/limits_test.go b/pkg/sentry/limits/limits_test.go
index d41f62554..945428163 100644
--- a/pkg/sentry/limits/limits_test.go
+++ b/pkg/sentry/limits/limits_test.go
@@ -20,18 +20,24 @@ import (
)
func TestSet(t *testing.T) {
- ls := NewLimitSet()
- ls.Set(1, Limit{Cur: 50, Max: 50})
- if _, err := ls.Set(1, Limit{Cur: 20, Max: 50}); err != nil {
- t.Fatalf("Tried to lower Limit to valid new value: got %v, wanted nil", err)
- }
- if _, err := ls.Set(1, Limit{Cur: 20, Max: 60}); err != syscall.EPERM {
- t.Fatalf("Tried to raise limit.Max to invalid higher value: got %v, wanted syscall.EPERM", err)
- }
- if _, err := ls.Set(1, Limit{Cur: 60, Max: 50}); err != syscall.EINVAL {
- t.Fatalf("Tried to raise limit.Cur to invalid higher value: got %v, wanted syscall.EINVAL", err)
+ testCases := []struct {
+ limit Limit
+ privileged bool
+ expectedErr error
+ }{
+ {limit: Limit{Cur: 50, Max: 50}, privileged: false, expectedErr: nil},
+ {limit: Limit{Cur: 20, Max: 50}, privileged: false, expectedErr: nil},
+ {limit: Limit{Cur: 20, Max: 60}, privileged: false, expectedErr: syscall.EPERM},
+ {limit: Limit{Cur: 60, Max: 50}, privileged: false, expectedErr: syscall.EINVAL},
+ {limit: Limit{Cur: 11, Max: 10}, privileged: false, expectedErr: syscall.EINVAL},
+ {limit: Limit{Cur: 20, Max: 60}, privileged: true, expectedErr: nil},
}
- if _, err := ls.Set(1, Limit{Cur: 11, Max: 10}); err != syscall.EINVAL {
- t.Fatalf("Tried to set new limit with Cur > Max: got %v, wanted syscall.EINVAL", err)
+
+ ls := NewLimitSet()
+ for _, tc := range testCases {
+ if _, err := ls.Set(1, tc.limit, tc.privileged); err != tc.expectedErr {
+ t.Fatalf("Tried to set Limit to %+v and privilege %t: got %v, wanted %v", tc.limit, tc.privileged, err, tc.expectedErr)
+ }
}
+
}
diff --git a/pkg/sentry/limits/linux.go b/pkg/sentry/limits/linux.go
index 295f9c398..e09d0d2fb 100644
--- a/pkg/sentry/limits/linux.go
+++ b/pkg/sentry/limits/linux.go
@@ -95,6 +95,6 @@ func NewLinuxDistroLimitSet() (*LimitSet, error) {
// 1,048,576 ought to be enough for anyone.
l := ls.Get(ProcessCount)
l.Cur = 1 << 20
- ls.Set(ProcessCount, l)
+ ls.Set(ProcessCount, l, true /* privileged */)
return ls, nil
}