On 01/17/2014 12:00 AM, Steve Beattie wrote:
> On Fri, Jan 17, 2014 at 12:45:27AM +0100, Christian Boltz wrote:
>> Am Donnerstag, 16. Januar 2014 schrieb Steve Beattie:
>>> This patch adds support for the rttime rlimit (aka RLIMIT_RTTIME),
>>> available since the 2.6.25 kernel, according to the getrlimit(2)
>>> man page; see that man page for more details on this rlimit.
>>> An acceptance test is also added.
>>
>>> Index: b/parser/tst/simple_tests/rlimits/ok_rlimit_18.sd
>>> ===================================================================
>>
>>> +profile rlimit {
>>> + set rlimit rttime <= 60minutes,
>>> +}
>>
>> Does this also need an addition for apparmor.vim.in?
>
> Yes, it does. In the course of reviewing what was correct formatting for
> rttime and other rlimits, I discovered that the units for rttime is
> measured in microseconds, not seconds like RLIMIT_CPU. Updated patch
> follows that addresses both issues:
>
> Subject: parser: add rttime rlimit support [v2]
>
> This patch adds support for the rttime rlimit (aka RLIMIT_RTTIME),
> available since the 2.6.25 kernel, according to the getrlimit(2)
> man page; see that man page for more details on this rlimit.
> An acceptance test is also added, as well as an update to the
> apparmor.vim input template.
>
> While reviewing to see what made sense in apparmor.vim for the rttime
> rlimit, I discovered that RLIMIT_RTTIME's units are microseconds, not
> seconds like RLIMIT_CPU (according to the setrlimit(2) manpage). This
> necessitated not sharing the case switch with RLIMIT_CPU. I didn't add
> a keyword for microseconds, but I did for milliseconds. I also don't
> accept any unit larger than minutes, as it didn't seem appropriate
> (and even minutes felt... gratuitous). I would appreciate feedback
> on what keywords would be useful here.
>
> Patch History:
> v1: initial submission
> v2: - add apparmor.vim support for rttime keyword
> - adjust RLIMIT_TIME value assignment due to its units being
> microseconds, not seconds, and add milliseconds keyword.
>
> Signed-off-by: Steve Beattie <[email protected]>
Acked-by: John Johansen <[email protected]>
> ---
> parser/parser_misc.c | 3 +++
> parser/parser_yacc.y | 17 +++++++++++++++++
> parser/tst/simple_tests/rlimits/ok_rlimit_18.sd | 7 +++++++
> utils/vim/apparmor.vim.in | 3 ++-
> 4 files changed, 29 insertions(+), 1 deletion(-)
>
> Index: b/parser/parser_misc.c
> ===================================================================
> --- a/parser/parser_misc.c
> +++ b/parser/parser_misc.c
> @@ -175,6 +175,9 @@ static struct keyword_table rlimit_table
> #ifdef RLIMIT_RTPRIO
> {"rtprio", RLIMIT_RTPRIO},
> #endif
> +#ifdef RLIMIT_RTTIME
> + {"rttime", RLIMIT_RTTIME},
> +#endif
> /* terminate */
> {NULL, 0}
> };
> Index: b/parser/parser_yacc.y
> ===================================================================
> --- a/parser/parser_yacc.y
> +++ b/parser/parser_yacc.y
> @@ -754,6 +754,7 @@ rules: rules TOK_SET TOK_RLIMIT TOK_ID T
> value = RLIM_INFINITY;
> } else {
> const char *seconds = "seconds";
> + const char *milliseconds = "ms";
> const char *minutes = "minutes";
> const char *hours = "hours";
> const char *days = "days";
> @@ -778,6 +779,22 @@ rules: rules TOK_SET TOK_RLIMIT TOK_ID T
> } else {
> yyerror("RLIMIT '%s' invalid value
> %s\n", $4, $6);
> }
> + break;
> + case RLIMIT_RTTIME:
> + /* RTTIME is measured in microseconds */
> + if (!end || $6 == end || tmp < 0)
> + yyerror("RLIMIT '%s' invalid value
> %s\n", $4, $6);
> + if (*end == '\0') {
> + value = tmp;
> + } else if (strstr(milliseconds, end) ==
> milliseconds) {
> + value = tmp * 1000;
> + } else if (strstr(seconds, end) == seconds) {
> + value = tmp * 1000 * 1000;
> + } else if (strstr(minutes, end) == minutes) {
> + value = tmp * 1000 * 1000 * 60;
> + } else {
> + yyerror("RLIMIT '%s' invalid value
> %s\n", $4, $6);
> + }
> break;
> case RLIMIT_NOFILE:
> case RLIMIT_NPROC:
> Index: b/parser/tst/simple_tests/rlimits/ok_rlimit_18.sd
> ===================================================================
> --- /dev/null
> +++ b/parser/tst/simple_tests/rlimits/ok_rlimit_18.sd
> @@ -0,0 +1,7 @@
> +#
> +#=DESCRIPTION simple realtime time rlimit test
> +#=EXRESULT PASS
> +
> +profile rlimit {
> + set rlimit rttime <= 60minutes,
> +}
> Index: b/utils/vim/apparmor.vim.in
> ===================================================================
> --- a/utils/vim/apparmor.vim.in
> +++ b/utils/vim/apparmor.vim.in
> @@ -160,7 +160,8 @@ syn match sdRLimit /\v^\s*set\s+rlimit\s
> syn match sdRLimit
> /\v^\s*set\s+rlimit\s+(fsize|data|stack|core|rss|as|memlock|msgqueue)\s+\<\=\s+[0-9]+([KMG]B)?@@EOL@@/
> contains=sdComment
> syn match sdRLimit
> /\v^\s*set\s+rlimit\s+nice\s+\<\=\s+(-1?[0-9]|-20|1?[0-9])@@EOL@@/
> contains=sdComment
> syn match sdRLimit
> /\v^\s*set\s+rlimit\s+cpu\s+\<\=\s+[0-9]+(seconds|minutes|hours|days)?@@EOL@@/
> contains=sdComment
> -syn match sdRLimit
> /\v^\s*set\s+rlimit\s+(cpu|nofile|nproc|rtprio|locks|sigpending|fsize|data|stack|core|rss|as|memlock|msgqueue|nice)\s+\<\=\s+infinity@@EOL@@/
> contains=sdComment
> +syn match sdRLimit
> /\v^\s*set\s+rlimit\s+rttime\s+\<\=\s+[0-9]+(ms|seconds|minutes)?@@EOL@@/
> contains=sdComment
> +syn match sdRLimit
> /\v^\s*set\s+rlimit\s+(cpu|rttime|nofile|nproc|rtprio|locks|sigpending|fsize|data|stack|core|rss|as|memlock|msgqueue|nice)\s+\<\=\s+infinity@@EOL@@/
> contains=sdComment
>
> " link rules
> syn match sdEntryW
> /\v^\s+@@auditdenyowner@@link\s+(subset\s+)?@@FILENAME@@\s+-\>\s+@@FILENAME@@@@EOL@@/
> contains=sdGlob
>
>
>
--
AppArmor mailing list
[email protected]
Modify settings or unsubscribe at:
https://lists.ubuntu.com/mailman/listinfo/apparmor
