summaryrefslogtreecommitdiffhomepage
path: root/pkg/sentry/limits
diff options
context:
space:
mode:
Diffstat (limited to 'pkg/sentry/limits')
-rw-r--r--pkg/sentry/limits/BUILD39
-rw-r--r--pkg/sentry/limits/context.go35
-rw-r--r--pkg/sentry/limits/limits.go128
-rw-r--r--pkg/sentry/limits/limits_test.go37
-rw-r--r--pkg/sentry/limits/linux.go100
5 files changed, 339 insertions, 0 deletions
diff --git a/pkg/sentry/limits/BUILD b/pkg/sentry/limits/BUILD
new file mode 100644
index 000000000..06c3e72b0
--- /dev/null
+++ b/pkg/sentry/limits/BUILD
@@ -0,0 +1,39 @@
+package(licenses = ["notice"]) # Apache 2.0
+
+load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_stateify")
+
+go_stateify(
+ name = "limits_state",
+ srcs = [
+ "limits.go",
+ ],
+ out = "limits_state.go",
+ package = "limits",
+)
+
+go_library(
+ name = "limits",
+ srcs = [
+ "context.go",
+ "limits.go",
+ "limits_state.go",
+ "linux.go",
+ ],
+ importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/limits",
+ visibility = ["//:sandbox"],
+ deps = [
+ "//pkg/abi/linux",
+ "//pkg/sentry/context",
+ "//pkg/state",
+ ],
+)
+
+go_test(
+ name = "limits_test",
+ size = "small",
+ srcs = [
+ "limits_test.go",
+ ],
+ embed = [":limits"],
+)
diff --git a/pkg/sentry/limits/context.go b/pkg/sentry/limits/context.go
new file mode 100644
index 000000000..75e97bf92
--- /dev/null
+++ b/pkg/sentry/limits/context.go
@@ -0,0 +1,35 @@
+// Copyright 2018 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package limits
+
+import (
+ "gvisor.googlesource.com/gvisor/pkg/sentry/context"
+)
+
+// contextID is the limit package's type for context.Context.Value keys.
+type contextID int
+
+const (
+ // CtxLimits is a Context.Value key for a LimitSet.
+ CtxLimits contextID = iota
+)
+
+// FromContext returns the limits that apply to ctx.
+func FromContext(ctx context.Context) *LimitSet {
+ if v := ctx.Value(CtxLimits); v != nil {
+ return v.(*LimitSet)
+ }
+ return nil
+}
diff --git a/pkg/sentry/limits/limits.go b/pkg/sentry/limits/limits.go
new file mode 100644
index 000000000..4230ba958
--- /dev/null
+++ b/pkg/sentry/limits/limits.go
@@ -0,0 +1,128 @@
+// Copyright 2018 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package limits provides resource limits.
+package limits
+
+import (
+ "sync"
+ "syscall"
+)
+
+// LimitType defines a type of resource limit.
+type LimitType int
+
+// Set of constants defining the different types of resource limits.
+const (
+ CPU LimitType = iota
+ FileSize
+ Data
+ Stack
+ Core
+ Rss
+ ProcessCount
+ NumberOfFiles
+ MemoryPagesLocked
+ AS
+ Locks
+ SignalsPending
+ MessageQueueBytes
+ Nice
+ RealTimePriority
+ Rttime
+)
+
+// Infinity is a constant representing a resource with no limit.
+const Infinity = ^uint64(0)
+
+// Limit specifies a system limit.
+type Limit struct {
+ // Cur specifies the current limit.
+ Cur uint64
+ // Max specifies the maximum settable limit.
+ Max uint64
+}
+
+// LimitSet represents the Limits that correspond to each LimitType.
+type LimitSet struct {
+ mu sync.Mutex `state:"nosave"`
+ data map[LimitType]Limit
+}
+
+// NewLimitSet creates a new, empty LimitSet.
+func NewLimitSet() *LimitSet {
+ return &LimitSet{
+ data: make(map[LimitType]Limit),
+ }
+}
+
+// GetCopy returns a clone of the LimitSet.
+func (l *LimitSet) GetCopy() *LimitSet {
+ l.mu.Lock()
+ defer l.mu.Unlock()
+ copyData := make(map[LimitType]Limit)
+ for k, v := range l.data {
+ copyData[k] = v
+ }
+ return &LimitSet{
+ data: copyData,
+ }
+}
+
+// Get returns the resource limit associated with LimitType t.
+// If no limit is provided, it defaults to an infinite limit.Infinity.
+func (l *LimitSet) Get(t LimitType) Limit {
+ l.mu.Lock()
+ defer l.mu.Unlock()
+ s, ok := l.data[t]
+ if !ok {
+ return Limit{Cur: Infinity, Max: Infinity}
+ }
+ return s
+}
+
+// GetCapped returns the current value for the limit, capped as specified.
+func (l *LimitSet) GetCapped(t LimitType, max uint64) uint64 {
+ s := l.Get(t)
+ if s.Cur == Infinity || s.Cur > max {
+ return max
+ }
+ return s.Cur
+}
+
+// SetUnchecked assigns value v to resource of LimitType t.
+func (l *LimitSet) SetUnchecked(t LimitType, v Limit) {
+ l.mu.Lock()
+ defer l.mu.Unlock()
+ l.data[t] = v
+}
+
+// Set assigns value v to resource of LimitType t and returns the old value.
+func (l *LimitSet) Set(t LimitType, v Limit) (Limit, error) {
+ l.mu.Lock()
+ defer l.mu.Unlock()
+ // If a limit is already set, make sure the new limit doesn't
+ // exceed the previous max limit.
+ if _, ok := l.data[t]; ok {
+ if l.data[t].Max < v.Max {
+ return Limit{}, syscall.EPERM
+ }
+ if v.Cur > v.Max {
+ return Limit{}, syscall.EINVAL
+ }
+ }
+ old := l.data[t]
+ l.data[t] = v
+ return old, nil
+}
diff --git a/pkg/sentry/limits/limits_test.go b/pkg/sentry/limits/limits_test.go
new file mode 100644
index 000000000..dd6f80750
--- /dev/null
+++ b/pkg/sentry/limits/limits_test.go
@@ -0,0 +1,37 @@
+// Copyright 2018 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package limits
+
+import (
+ "syscall"
+ "testing"
+)
+
+func TestSet(t *testing.T) {
+ ls := NewLimitSet()
+ ls.Set(1, Limit{Cur: 50, Max: 50})
+ if _, err := ls.Set(1, Limit{Cur: 20, Max: 50}); err != nil {
+ t.Fatalf("Tried to lower Limit to valid new value: got %v, wanted nil", err)
+ }
+ if _, err := ls.Set(1, Limit{Cur: 20, Max: 60}); err != syscall.EPERM {
+ t.Fatalf("Tried to raise limit.Max to invalid higher value: got %v, wanted syscall.EPERM", err)
+ }
+ if _, err := ls.Set(1, Limit{Cur: 60, Max: 50}); err != syscall.EINVAL {
+ t.Fatalf("Tried to raise limit.Cur to invalid higher value: got %v, wanted syscall.EINVAL", err)
+ }
+ if _, err := ls.Set(1, Limit{Cur: 11, Max: 10}); err != syscall.EINVAL {
+ t.Fatalf("Tried to set new limit with Cur > Max: got %v, wanted syscall.EINVAL", err)
+ }
+}
diff --git a/pkg/sentry/limits/linux.go b/pkg/sentry/limits/linux.go
new file mode 100644
index 000000000..8e6a24341
--- /dev/null
+++ b/pkg/sentry/limits/linux.go
@@ -0,0 +1,100 @@
+// Copyright 2018 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package limits
+
+import (
+ "fmt"
+
+ "gvisor.googlesource.com/gvisor/pkg/abi/linux"
+)
+
+// FromLinuxResource maps linux resources to sentry LimitTypes.
+var FromLinuxResource = map[int]LimitType{
+ linux.RLIMIT_CPU: CPU,
+ linux.RLIMIT_FSIZE: FileSize,
+ linux.RLIMIT_DATA: Data,
+ linux.RLIMIT_STACK: Stack,
+ linux.RLIMIT_CORE: Core,
+ linux.RLIMIT_RSS: Rss,
+ linux.RLIMIT_NPROC: ProcessCount,
+ linux.RLIMIT_NOFILE: NumberOfFiles,
+ linux.RLIMIT_MEMLOCK: MemoryPagesLocked,
+ linux.RLIMIT_AS: AS,
+ linux.RLIMIT_LOCKS: Locks,
+ linux.RLIMIT_SIGPENDING: SignalsPending,
+ linux.RLIMIT_MSGQUEUE: MessageQueueBytes,
+ linux.RLIMIT_NICE: Nice,
+ linux.RLIMIT_RTPRIO: RealTimePriority,
+ linux.RLIMIT_RTTIME: Rttime,
+}
+
+// FromLinux maps linux rlimit values to sentry Limits, being careful to handle
+// infinities.
+func FromLinux(rl uint64) uint64 {
+ if rl == linux.RLimInfinity {
+ return Infinity
+ }
+ return rl
+}
+
+// ToLinux maps sentry Limits to linux rlimit values, being careful to handle
+// infinities.
+func ToLinux(l uint64) uint64 {
+ if l == Infinity {
+ return linux.RLimInfinity
+ }
+ return l
+}
+
+// NewLinuxLimitSet returns a LimitSet whose values match the default rlimits
+// in Linux.
+func NewLinuxLimitSet() (*LimitSet, error) {
+ ls := NewLimitSet()
+ for rlt, rl := range linux.InitRLimits {
+ lt, ok := FromLinuxResource[rlt]
+ if !ok {
+ return nil, fmt.Errorf("unknown rlimit type %v", rlt)
+ }
+ ls.SetUnchecked(lt, Limit{
+ Cur: FromLinux(rl.Cur),
+ Max: FromLinux(rl.Max),
+ })
+ }
+ return ls, nil
+}
+
+// NewLinuxDistroLimitSet returns a new LimitSet whose values are typical
+// for a booted Linux distro.
+//
+// Many Linux init systems adjust the default Linux limits to values more
+// expected by the rest of the userspace. NewLinuxDistroLimitSet returns a
+// LimitSet with sensible defaults for applications that aren't starting
+// their own init system.
+func NewLinuxDistroLimitSet() (*LimitSet, error) {
+ ls, err := NewLinuxLimitSet()
+ if err != nil {
+ return nil, err
+ }
+
+ // Adjust ProcessCount to a lower value because GNU bash allocates 16
+ // bytes per proc and OOMs if this number is set too high. Value was
+ // picked arbitrarily.
+ //
+ // 1,048,576 ought to be enough for anyone.
+ l := ls.Get(ProcessCount)
+ l.Cur = 1 << 20
+ ls.Set(ProcessCount, l)
+ return ls, nil
+}
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-01 14:39:32 +0000