dilim/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2026-08-08 17:10:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #10935 from poettering/rlimit-nofile-safe

Browse Source 
Merged by hand to resolve a trivial conflict in TODO.
This commit is contained in:
Zbigniew Jędrzejewski-Szmek
2018-12-06 17:19:21 +01:00
parent f0a43eb821 707b3fbd57
commit 871fa294ff
29 changed files with 124 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/shared/exec-util.c
View File

@@ -17,6 +17,7 @@
#include "hashmap.h"
#include "macro.h"
#include "process-util.h"
#include "rlimit-util.h"
#include "serialize.h"
#include "set.h"
#include "signal-util.h"
@@ -52,6 +53,8 @@ static int do_spawn(const char *path, char *argv[], int stdout_fd, pid_t *pid) {
_exit(EXIT_FAILURE);
}
(void) rlimit_nofile_safe();
if (!argv) {
_argv[0] = (char*) path;
_argv[1] = NULL;

2
src/shared/meson.build
View File

@@ -120,8 +120,6 @@ shared_sources = files('''
reboot-util.h
resolve-util.c
resolve-util.h
rlimit-util.c
rlimit-util.h
seccomp-util.h
securebits-util.c
securebits-util.h

46
src/shared/pager.c
View File

@@ -19,6 +19,7 @@
#include "macro.h"
#include "pager.h"
#include "process-util.h"
#include "rlimit-util.h"
#include "signal-util.h"
#include "string-util.h"
#include "strv.h"
@@ -55,7 +56,7 @@ static int no_quit_on_interrupt(int exe_name_fd, const char *less_opts) {
file = fdopen(exe_name_fd, "r");
if (!file) {
safe_close(exe_name_fd);
return log_debug_errno(errno, "Failed to create FILE object: %m");
return log_error_errno(errno, "Failed to create FILE object: %m");
}
/* Find the last line */
@@ -64,7 +65,7 @@ static int no_quit_on_interrupt(int exe_name_fd, const char *less_opts) {
r = read_line(file, LONG_LINE_MAX, &t);
if (r < 0)
return r;
return log_error_errno(r, "Failed to read from socket: %m");
if (r == 0)
break;
@@ -96,7 +97,7 @@ int pager_open(PagerFlags flags) {
return 0;
if (!is_main_thread())
return -EPERM;
return log_error_errno(SYNTHETIC_ERRNO(EPERM), "Pager invoked from wrong thread.");
pager = getenv("SYSTEMD_PAGER");
if (!pager)
@@ -105,7 +106,7 @@ int pager_open(PagerFlags flags) {
if (pager) {
pager_args = strv_split(pager, WHITESPACE);
if (!pager_args)
return -ENOMEM;
return log_oom();
/* If the pager is explicitly turned off, honour it */
if (strv_isempty(pager_args) || strv_equal(pager_args, STRV_MAKE("cat")))
@@ -131,7 +132,7 @@ int pager_open(PagerFlags flags) {
if (flags & PAGER_JUMP_TO_END)
less_opts = strjoina(less_opts, " +G");
r = safe_fork("(pager)", FORK_RESET_SIGNALS|FORK_DEATHSIG|FORK_LOG, &pager_pid);
r = safe_fork_full("(pager)", fd, 2, FORK_RESET_SIGNALS|FORK_CLOSE_ALL_FDS|FORK_DEATHSIG|FORK_RLIMIT_NOFILE_SAFE|FORK_LOG, &pager_pid);
if (r < 0)
return r;
if (r == 0) {
@@ -139,11 +140,17 @@ int pager_open(PagerFlags flags) {
/* In the child start the pager */
(void) dup2(fd[0], STDIN_FILENO);
if (dup2(fd[0], STDIN_FILENO) < 0) {
log_error_errno(errno, "Failed to duplicate file descriptor to STDIN: %m");
_exit(EXIT_FAILURE);
}
safe_close_pair(fd);
if (setenv("LESS", less_opts, 1) < 0)
if (setenv("LESS", less_opts, 1) < 0) {
log_error_errno(errno, "Failed to set environment variable LESS: %m");
_exit(EXIT_FAILURE);
}
/* Initialize a good charset for less. This is
* particularly important if we output UTF-8
@@ -152,14 +159,21 @@ int pager_open(PagerFlags flags) {
if (!less_charset && is_locale_utf8())
less_charset = "utf-8";
if (less_charset &&
setenv("LESSCHARSET", less_charset, 1) < 0)
setenv("LESSCHARSET", less_charset, 1) < 0) {
log_error_errno(errno, "Failed to set environment variable LESSCHARSET: %m");
_exit(EXIT_FAILURE);
}
if (pager_args) {
if (loop_write(exe_name_pipe[1], pager_args[0], strlen(pager_args[0]) + 1, false) < 0)
r = loop_write(exe_name_pipe[1], pager_args[0], strlen(pager_args[0]) + 1, false);
if (r < 0) {
log_error_errno(r, "Failed to write pager name to socket: %m");
_exit(EXIT_FAILURE);
}
execvp(pager_args[0], pager_args);
log_full_errno(errno == ENOENT ? LOG_DEBUG : LOG_WARNING, errno,
"Failed execute %s, using fallback pagers: %m", pager_args[0]);
}
/* Debian's alternatives command for pagers is
@@ -169,13 +183,21 @@ int pager_open(PagerFlags flags) {
* is similar to this one anyway, but is
* Debian-specific. */
FOREACH_STRING(exe, "pager", "less", "more") {
if (loop_write(exe_name_pipe[1], exe, strlen(exe) + 1, false) < 0)
r = loop_write(exe_name_pipe[1], exe, strlen(exe) + 1, false);
if (r < 0) {
log_error_errno(r, "Failed to write pager name to socket: %m");
_exit(EXIT_FAILURE);
}
execlp(exe, exe, NULL);
log_full_errno(errno == ENOENT ? LOG_DEBUG : LOG_WARNING, errno,
"Failed execute %s, using next fallback pager: %m", exe);
}
if (loop_write(exe_name_pipe[1], "(built-in)", strlen("(built-in") + 1, false) < 0)
r = loop_write(exe_name_pipe[1], "(built-in)", strlen("(built-in") + 1, false);
if (r < 0) {
log_error_errno(r, "Failed to write pager name to socket: %m");
_exit(EXIT_FAILURE);
}
pager_fallback();
/* not reached */
}
@@ -256,7 +278,7 @@ int show_man_page(const char *desc, bool null_stdio) {
} else
args[1] = desc;
r = safe_fork("(man)", FORK_RESET_SIGNALS|FORK_DEATHSIG|(null_stdio ? FORK_NULL_STDIO : 0)|FORK_LOG, &pid);
r = safe_fork("(man)", FORK_RESET_SIGNALS|FORK_DEATHSIG|(null_stdio ? FORK_NULL_STDIO : 0)|FORK_RLIMIT_NOFILE_SAFE|FORK_LOG, &pid);
if (r < 0)
return r;
if (r == 0) {

391
src/shared/rlimit-util.c
View File

@@ -1,391 +0,0 @@
/* SPDX-License-Identifier: LGPL-2.1+ */
#include <errno.h>
#include <sys/resource.h>
#include "alloc-util.h"
#include "extract-word.h"
#include "fd-util.h"
#include "format-util.h"
#include "macro.h"
#include "missing.h"
#include "rlimit-util.h"
#include "string-table.h"
#include "time-util.h"
int setrlimit_closest(int resource, const struct rlimit *rlim) {
struct rlimit highest, fixed;
assert(rlim);
if (setrlimit(resource, rlim) >= 0)
return 0;
if (errno != EPERM)
return -errno;
/* So we failed to set the desired setrlimit, then let's try
* to get as close as we can */
if (getrlimit(resource, &highest) < 0)
return -errno;
/* If the hard limit is unbounded anyway, then the EPERM had other reasons, let's propagate the original EPERM
* then */
if (highest.rlim_max == RLIM_INFINITY)
return -EPERM;
fixed = (struct rlimit) {
.rlim_cur = MIN(rlim->rlim_cur, highest.rlim_max),
.rlim_max = MIN(rlim->rlim_max, highest.rlim_max),
};
/* Shortcut things if we wouldn't change anything. */
if (fixed.rlim_cur == highest.rlim_cur &&
fixed.rlim_max == highest.rlim_max)
return 0;
if (setrlimit(resource, &fixed) < 0)
return -errno;
return 0;
}
int setrlimit_closest_all(const struct rlimit *const *rlim, int *which_failed) {
int i, r;
assert(rlim);
/* On failure returns the limit's index that failed in *which_failed, but only if non-NULL */
for (i = 0; i < _RLIMIT_MAX; i++) {
if (!rlim[i])
continue;
r = setrlimit_closest(i, rlim[i]);
if (r < 0) {
if (which_failed)
*which_failed = i;
return r;
}
}
if (which_failed)
*which_failed = -1;
return 0;
}
static int rlimit_parse_u64(const char *val, rlim_t *ret) {
uint64_t u;
int r;
assert(val);
assert(ret);
if (streq(val, "infinity")) {
*ret = RLIM_INFINITY;
return 0;
}
/* setrlimit(2) suggests rlim_t is always 64bit on Linux. */
assert_cc(sizeof(rlim_t) == sizeof(uint64_t));
r = safe_atou64(val, &u);
if (r < 0)
return r;
if (u >= (uint64_t) RLIM_INFINITY)
return -ERANGE;
*ret = (rlim_t) u;
return 0;
}
static int rlimit_parse_size(const char *val, rlim_t *ret) {
uint64_t u;
int r;
assert(val);
assert(ret);
if (streq(val, "infinity")) {
*ret = RLIM_INFINITY;
return 0;
}
r = parse_size(val, 1024, &u);
if (r < 0)
return r;
if (u >= (uint64_t) RLIM_INFINITY)
return -ERANGE;
*ret = (rlim_t) u;
return 0;
}
static int rlimit_parse_sec(const char *val, rlim_t *ret) {
uint64_t u;
usec_t t;
int r;
assert(val);
assert(ret);
if (streq(val, "infinity")) {
*ret = RLIM_INFINITY;
return 0;
}
r = parse_sec(val, &t);
if (r < 0)
return r;
if (t == USEC_INFINITY) {
*ret = RLIM_INFINITY;
return 0;
}
u = (uint64_t) DIV_ROUND_UP(t, USEC_PER_SEC);
if (u >= (uint64_t) RLIM_INFINITY)
return -ERANGE;
*ret = (rlim_t) u;
return 0;
}
static int rlimit_parse_usec(const char *val, rlim_t *ret) {
usec_t t;
int r;
assert(val);
assert(ret);
if (streq(val, "infinity")) {
*ret = RLIM_INFINITY;
return 0;
}
r = parse_time(val, &t, 1);
if (r < 0)
return r;
if (t == USEC_INFINITY) {
*ret = RLIM_INFINITY;
return 0;
}
*ret = (rlim_t) t;
return 0;
}
static int rlimit_parse_nice(const char *val, rlim_t *ret) {
uint64_t rl;
int r;
/* So, Linux is weird. The range for RLIMIT_NICE is 40..1, mapping to the nice levels -20..19. However, the
* RLIMIT_NICE limit defaults to 0 by the kernel, i.e. a value that maps to nice level 20, which of course is
* bogus and does not exist. In order to permit parsing the RLIMIT_NICE of 0 here we hence implement a slight
* asymmetry: when parsing as positive nice level we permit 0..19. When parsing as negative nice level, we
* permit -20..0. But when parsing as raw resource limit value then we also allow the special value 0.
*
* Yeah, Linux is quality engineering sometimes... */
if (val[0] == '+') {
/* Prefixed with "+": Parse as positive user-friendly nice value */
r = safe_atou64(val + 1, &rl);
if (r < 0)
return r;
if (rl >= PRIO_MAX)
return -ERANGE;
rl = 20 - rl;
} else if (val[0] == '-') {
/* Prefixed with "-": Parse as negative user-friendly nice value */
r = safe_atou64(val + 1, &rl);
if (r < 0)
return r;
if (rl > (uint64_t) (-PRIO_MIN))
return -ERANGE;
rl = 20 + rl;
} else {
/* Not prefixed: parse as raw resource limit value */
r = safe_atou64(val, &rl);
if (r < 0)
return r;
if (rl > (uint64_t) (20 - PRIO_MIN))
return -ERANGE;
}
*ret = (rlim_t) rl;
return 0;
}
static int (*const rlimit_parse_table[_RLIMIT_MAX])(const char *val, rlim_t *ret) = {
[RLIMIT_CPU] = rlimit_parse_sec,
[RLIMIT_FSIZE] = rlimit_parse_size,
[RLIMIT_DATA] = rlimit_parse_size,
[RLIMIT_STACK] = rlimit_parse_size,
[RLIMIT_CORE] = rlimit_parse_size,
[RLIMIT_RSS] = rlimit_parse_size,
[RLIMIT_NOFILE] = rlimit_parse_u64,
[RLIMIT_AS] = rlimit_parse_size,
[RLIMIT_NPROC] = rlimit_parse_u64,
[RLIMIT_MEMLOCK] = rlimit_parse_size,
[RLIMIT_LOCKS] = rlimit_parse_u64,
[RLIMIT_SIGPENDING] = rlimit_parse_u64,
[RLIMIT_MSGQUEUE] = rlimit_parse_size,
[RLIMIT_NICE] = rlimit_parse_nice,
[RLIMIT_RTPRIO] = rlimit_parse_u64,
[RLIMIT_RTTIME] = rlimit_parse_usec,
};
int rlimit_parse_one(int resource, const char *val, rlim_t *ret) {
assert(val);
assert(ret);
if (resource < 0)
return -EINVAL;
if (resource >= _RLIMIT_MAX)
return -EINVAL;
return rlimit_parse_table[resource](val, ret);
}
int rlimit_parse(int resource, const char *val, struct rlimit *ret) {
_cleanup_free_ char *hard = NULL, *soft = NULL;
rlim_t hl, sl;
int r;
assert(val);
assert(ret);
r = extract_first_word(&val, &soft, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
if (r < 0)
return r;
if (r == 0)
return -EINVAL;
r = rlimit_parse_one(resource, soft, &sl);
if (r < 0)
return r;
r = extract_first_word(&val, &hard, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
if (r < 0)
return r;
if (!isempty(val))
return -EINVAL;
if (r == 0)
hl = sl;
else {
r = rlimit_parse_one(resource, hard, &hl);
if (r < 0)
return r;
if (sl > hl)
return -EILSEQ;
}
*ret = (struct rlimit) {
.rlim_cur = sl,
.rlim_max = hl,
};
return 0;
}
int rlimit_format(const struct rlimit *rl, char **ret) {
char *s = NULL;
assert(rl);
assert(ret);
if (rl->rlim_cur >= RLIM_INFINITY && rl->rlim_max >= RLIM_INFINITY)
s = strdup("infinity");
else if (rl->rlim_cur >= RLIM_INFINITY)
(void) asprintf(&s, "infinity:" RLIM_FMT, rl->rlim_max);
else if (rl->rlim_max >= RLIM_INFINITY)
(void) asprintf(&s, RLIM_FMT ":infinity", rl->rlim_cur);
else if (rl->rlim_cur == rl->rlim_max)
(void) asprintf(&s, RLIM_FMT, rl->rlim_cur);
else
(void) asprintf(&s, RLIM_FMT ":" RLIM_FMT, rl->rlim_cur, rl->rlim_max);
if (!s)
return -ENOMEM;
*ret = s;
return 0;
}
static const char* const rlimit_table[_RLIMIT_MAX] = {
[RLIMIT_AS] = "AS",
[RLIMIT_CORE] = "CORE",
[RLIMIT_CPU] = "CPU",
[RLIMIT_DATA] = "DATA",
[RLIMIT_FSIZE] = "FSIZE",
[RLIMIT_LOCKS] = "LOCKS",
[RLIMIT_MEMLOCK] = "MEMLOCK",
[RLIMIT_MSGQUEUE] = "MSGQUEUE",
[RLIMIT_NICE] = "NICE",
[RLIMIT_NOFILE] = "NOFILE",
[RLIMIT_NPROC] = "NPROC",
[RLIMIT_RSS] = "RSS",
[RLIMIT_RTPRIO] = "RTPRIO",
[RLIMIT_RTTIME] = "RTTIME",
[RLIMIT_SIGPENDING] = "SIGPENDING",
[RLIMIT_STACK] = "STACK",
};
DEFINE_STRING_TABLE_LOOKUP(rlimit, int);
int rlimit_from_string_harder(const char *s) {
const char *suffix;
/* The official prefix */
suffix = startswith(s, "RLIMIT_");
if (suffix)
return rlimit_from_string(suffix);
/* Our own unit file setting prefix */
suffix = startswith(s, "Limit");
if (suffix)
return rlimit_from_string(suffix);
return rlimit_from_string(s);
}
void rlimit_free_all(struct rlimit **rl) {
int i;
if (!rl)
return;
for (i = 0; i < _RLIMIT_MAX; i++)
rl[i] = mfree(rl[i]);
}
int rlimit_nofile_bump(int limit) {
int r;
/* Bumps the (soft) RLIMIT_NOFILE resource limit as close as possible to the specified limit. If a negative
* limit is specified, bumps it to the maximum the kernel and the hard resource limit allows. This call should
* be used by all our programs that might need a lot of fds, and that know how to deal with high fd numbers
* (i.e. do not use select() — which chokes on fds >= 1024) */
if (limit < 0)
limit = read_nr_open();
if (limit < 3)
limit = 3;
r = setrlimit_closest(RLIMIT_NOFILE, &RLIMIT_MAKE_CONST(limit));
if (r < 0)
return log_debug_errno(r, "Failed to set RLIMIT_NOFILE: %m");
return 0;
}

24
src/shared/rlimit-util.h
View File

@@ -1,24 +0,0 @@
/* SPDX-License-Identifier: LGPL-2.1+ */
#pragma once
#include <sys/resource.h>
#include "macro.h"
const char *rlimit_to_string(int i) _const_;
int rlimit_from_string(const char *s) _pure_;
int rlimit_from_string_harder(const char *s) _pure_;
int setrlimit_closest(int resource, const struct rlimit *rlim);
int setrlimit_closest_all(const struct rlimit * const *rlim, int *which_failed);
int rlimit_parse_one(int resource, const char *val, rlim_t *ret);
int rlimit_parse(int resource, const char *val, struct rlimit *ret);
int rlimit_format(const struct rlimit *rl, char **ret);
void rlimit_free_all(struct rlimit **rl);
#define RLIMIT_MAKE_CONST(lim) ((struct rlimit) { lim, lim })
int rlimit_nofile_bump(int limit);