src/lib/restrict-process-size.c

	restrict-process-size.c revision bcb4e51a409d94ae670de96afb8483a4f7855294
bcb4e51a409d94ae670de96afb8483a4f7855294Stephan Bosch/* Copyright (c) 2002-2018 Dovecot authors, see the included COPYING file */
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen#include "lib.h"
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen#include "restrict-process-size.h"
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen#include <unistd.h>
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainenvoid restrict_process_size(rlim_t bytes)
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen{
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen    struct rlimit rlim;
bd63b5b860658b01b1f46f26d406e1e4a9dc019aTimo Sirainen
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen    rlim.rlim_max = rlim.rlim_cur = bytes;
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen    if (setrlimit(RLIMIT_DATA, &rlim) < 0) {
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen        i_fatal("setrlimit(RLIMIT_DATA, %llu): %m",
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen            (unsigned long long)bytes);
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen    }
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen#ifdef HAVE_RLIMIT_AS
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen    if (setrlimit(RLIMIT_AS, &rlim) < 0) {
de62ce819d59a529530da4b57be1b8d6dad13d6bTimo Sirainen        i_fatal("setrlimit(RLIMIT_AS, %llu): %m",
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen            (unsigned long long)bytes);
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen    }
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen#endif
efe78d3ba24fc866af1c79b9223dc0809ba26cadStephan Bosch}
c37098f8ce6d512ba41f09564d04ed25720f0a77Timo Sirainen
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainenvoid restrict_process_count(rlim_t count ATTR_UNUSED)
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen{
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen#ifdef HAVE_RLIMIT_NPROC
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen    struct rlimit rlim;
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen    rlim.rlim_max = rlim.rlim_cur = count;
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen    if (setrlimit(RLIMIT_NPROC, &rlim) < 0) {
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen        i_error("setrlimit(RLIMIT_NPROC, %llu): %m",
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen            (unsigned long long)count);
de62ce819d59a529530da4b57be1b8d6dad13d6bTimo Sirainen    }
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen#endif
57b523eeb99ed5d7f5002907a409cdef54353ce5Timo Sirainen}
57b523eeb99ed5d7f5002907a409cdef54353ce5Timo Sirainen
57b523eeb99ed5d7f5002907a409cdef54353ce5Timo Sirainenvoid restrict_fd_limit(rlim_t count)
57b523eeb99ed5d7f5002907a409cdef54353ce5Timo Sirainen{
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen#ifdef HAVE_SETRLIMIT
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen    struct rlimit rlim;
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen    rlim.rlim_cur = rlim.rlim_max = count;
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen    if (setrlimit(RLIMIT_NOFILE, &rlim) < 0) {
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen        i_error("setrlimit(RLIMIT_NOFILE, %llu): %m",
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen            (unsigned long long)count);
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen    }
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen#endif
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen}
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen
5ab440dddf60e749ea988869552d3425fdc2512aTimo Sirainenint restrict_get_process_size(rlim_t *limit_r)
5ab440dddf60e749ea988869552d3425fdc2512aTimo Sirainen{
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen    struct rlimit rlim;
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen
0b3e92b6043435c5aa9f1cf1d04b632f3e19abd9Phil Carmody#ifdef HAVE_RLIMIT_AS
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen    if (getrlimit(RLIMIT_AS, &rlim) < 0) {
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen        i_error("getrlimit(RLIMIT_AS): %m");
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen        return -1;
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen    }
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen#else
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen    if (getrlimit(RLIMIT_DATA, &rlim) < 0) {
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen        i_error("getrlimit(RLIMIT_DATA): %m");
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen        return -1;
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen    }
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen#endif
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen    *limit_r = rlim.rlim_cur;
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen    return 0;
39ed514f9d401b3cb589595c6a2f532050254d77Timo Sirainen}

int restrict_get_core_limit(rlim_t *limit_r)
{
#ifdef HAVE_RLIMIT_CORE
    struct rlimit rlim;

    if (getrlimit(RLIMIT_CORE, &rlim) < 0) {
        i_error("getrlimit(RLIMIT_CORE) failed: %m");
        return -1;
    }
    *limit_r = rlim.rlim_cur;
    return 0;
#else
    return -1;
#endif
}

int restrict_get_process_limit(rlim_t *limit_r)
{
#ifdef HAVE_RLIMIT_NPROC
    struct rlimit rlim;

    if (getrlimit(RLIMIT_NPROC, &rlim) < 0) {
        i_error("getrlimit(RLIMIT_NPROC) failed: %m");
        return -1;
    }
    *limit_r = rlim.rlim_cur;
    return 0;
#else
    return -1;
#endif
}

int restrict_get_fd_limit(rlim_t *limit_r)
{
    struct rlimit rlim;

    if (getrlimit(RLIMIT_NOFILE, &rlim) < 0) {
        i_error("getrlimit(RLIMIT_NOFILE) failed: %m");
        return -1;
    }
    *limit_r = rlim.rlim_cur;
    return 0;
}