dilim/moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2026-08-08 17:11:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

daemon: modifyRootKeyLimit: cleanup and touch-up godoc

Browse Source 
Simplify some of the code and touch-up GoDoc to reference the current
kernel defaults.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This commit is contained in:
Sebastiaan van Stijn
2026-07-03 18:05:15 +02:00
parent 01093f42ab
commit b36ec079a8
1 changed files with 23 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

52
daemon/keys.go
View File

@@ -3,56 +3,50 @@
package daemon
import (
"bytes"
"os"
"strconv"
"strings"
)
const (
rootKeyFile = "/proc/sys/kernel/keys/root_maxkeys"
rootBytesFile = "/proc/sys/kernel/keys/root_maxbytes"
rootKeyLimit = 1000000
// it is standard configuration to allocate 25 bytes per key
rootKeyByteMultiplier = 25
// These match the upstream Linux defaults for key_quota_root_maxkeys
// and key_quota_root_maxbytes since kernel 3.17.
//
// https://github.com/torvalds/linux/commit/738c5d190f6540539a04baf36ce21d46b5da04bd
// https://github.com/torvalds/linux/blob/738c5d190f6540539a04baf36ce21d46b5da04bd/security/keys/key.c#L30-L33
rootMaxKeys = 1000000
rootMaxBytes = 25 * rootMaxKeys
)
// modifyRootKeyLimit checks to see if the root key limit is set to
// at least 1000000 and changes it to that limit along with the maxbytes
// allocated to the keys at a 25 to 1 multiplier.
// modifyRootKeyLimit raises the root user's key quota to the upstream
// Linux defaults introduced in kernel 3.17 if the configured limit is
// lower. This avoids exhausting the root key quota on older kernels or
// systems configured with legacy limits.
//
// see https://github.com/moby/moby/issues/22865
func modifyRootKeyLimit() error {
value, err := readRootKeyLimit(rootKeyFile)
if err != nil {
return err
}
if value < rootKeyLimit {
return setRootKeyLimit(rootKeyLimit)
if value < rootMaxKeys {
if err := os.WriteFile(rootKeyFile, []byte(strconv.Itoa(rootMaxKeys)), 0); err != nil {
return err
}
if err := os.WriteFile(rootBytesFile, []byte(strconv.Itoa(rootMaxBytes)), 0); err != nil {
return err
}
}
return nil
}
func setRootKeyLimit(limit int) error {
keys, err := os.OpenFile(rootKeyFile, os.O_WRONLY, 0)
if err != nil {
return err
}
defer keys.Close()
_, err = keys.WriteString(strconv.Itoa(limit))
if err != nil {
return err
}
bytes, err := os.OpenFile(rootBytesFile, os.O_WRONLY, 0)
if err != nil {
return err
}
defer bytes.Close()
_, err = bytes.WriteString(strconv.Itoa(limit * rootKeyByteMultiplier))
return err
}
func readRootKeyLimit(path string) (int, error) {
data, err := os.ReadFile(path)
if err != nil {
return -1, err
}
return strconv.Atoi(strings.Trim(string(data), "\n"))
return strconv.Atoi(string(bytes.TrimSuffix(data, []byte{'\n'})))
}