Github/nsjail
1
0
Fork 0
mirror of https://github.com/google/nsjail.git synced 2026-08-30 18:41:30 -07:00
Code Issues Packages Projects Releases Wiki Activity

Fix inherited rlimit handling for CLI options

Browse Source
This commit is contained in:
n-agi
2026-03-19 11:17:29 +00:00
parent f78475530b
commit dc5338c637
2 changed files with 60 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

59
cmdline.cc
View File

@@ -327,6 +327,25 @@ void logParams(nsj_t* nsj) {
} }
} }
nsjail::RLimit parseRLimitType(int res, const char* optarg) {
if (strcasecmp(optarg, "def") == 0 || strcasecmp(optarg, "soft") == 0) {
return nsjail::RLimit::SOFT;
}
if (strcasecmp(optarg, "max") == 0 || strcasecmp(optarg, "hard") == 0) {
return nsjail::RLimit::HARD;
}
if (strcasecmp(optarg, "inf") == 0) {
return nsjail::RLimit::INF;
}
if (util::isANumber(optarg)) {
return nsjail::RLimit::VALUE;
}
LOG_F("RLIMIT %s (%d) needs a numeric value or 'max'/'hard'/'def'/'soft'/'inf' "
"value (%s provided)",
util::rLimName(res).c_str(), res, QC(optarg));
abort();
}
uint64_t parseRLimit(int res, const char* optarg, unsigned long mul) { uint64_t parseRLimit(int res, const char* optarg, unsigned long mul) {
if (strcasecmp(optarg, "inf") == 0) { if (strcasecmp(optarg, "inf") == 0) {
return RLIM64_INFINITY; return RLIM64_INFINITY;
@@ -550,44 +569,64 @@ std::unique_ptr<nsj_t> parseArgs(int argc, char* argv[]) {
exit(0); exit(0);
break; break;
case 0x0201: case 0x0201:
nsj->njc.set_rlimit_as_type(parseRLimitType(RLIMIT_AS, optarg));
if (nsj->njc.rlimit_as_type() == nsjail::RLimit::VALUE) {
nsj->njc.set_rlimit_as(parseRLimit(RLIMIT_AS, optarg, 1)); nsj->njc.set_rlimit_as(parseRLimit(RLIMIT_AS, optarg, 1));
nsj->njc.set_rlimit_as_type(nsjail::RLimit::VALUE); }
break; break;
case 0x0202: case 0x0202:
nsj->njc.set_rlimit_core_type(parseRLimitType(RLIMIT_CORE, optarg));
if (nsj->njc.rlimit_core_type() == nsjail::RLimit::VALUE) {
nsj->njc.set_rlimit_core(parseRLimit(RLIMIT_CORE, optarg, 1)); nsj->njc.set_rlimit_core(parseRLimit(RLIMIT_CORE, optarg, 1));
nsj->njc.set_rlimit_core_type(nsjail::RLimit::VALUE); }
break; break;
case 0x0203: case 0x0203:
nsj->njc.set_rlimit_cpu_type(parseRLimitType(RLIMIT_CPU, optarg));
if (nsj->njc.rlimit_cpu_type() == nsjail::RLimit::VALUE) {
nsj->njc.set_rlimit_cpu(parseRLimit(RLIMIT_CPU, optarg, 1)); nsj->njc.set_rlimit_cpu(parseRLimit(RLIMIT_CPU, optarg, 1));
nsj->njc.set_rlimit_cpu_type(nsjail::RLimit::VALUE); }
break; break;
case 0x0204: case 0x0204:
nsj->njc.set_rlimit_fsize_type(parseRLimitType(RLIMIT_FSIZE, optarg));
if (nsj->njc.rlimit_fsize_type() == nsjail::RLimit::VALUE) {
nsj->njc.set_rlimit_fsize(parseRLimit(RLIMIT_FSIZE, optarg, 1)); nsj->njc.set_rlimit_fsize(parseRLimit(RLIMIT_FSIZE, optarg, 1));
nsj->njc.set_rlimit_fsize_type(nsjail::RLimit::VALUE); }
break; break;
case 0x0205: case 0x0205:
nsj->njc.set_rlimit_nofile_type(parseRLimitType(RLIMIT_NOFILE, optarg));
if (nsj->njc.rlimit_nofile_type() == nsjail::RLimit::VALUE) {
nsj->njc.set_rlimit_nofile(parseRLimit(RLIMIT_NOFILE, optarg, 1)); nsj->njc.set_rlimit_nofile(parseRLimit(RLIMIT_NOFILE, optarg, 1));
nsj->njc.set_rlimit_nofile_type(nsjail::RLimit::VALUE); }
break; break;
case 0x0206: case 0x0206:
nsj->njc.set_rlimit_nproc_type(parseRLimitType(RLIMIT_NPROC, optarg));
if (nsj->njc.rlimit_nproc_type() == nsjail::RLimit::VALUE) {
nsj->njc.set_rlimit_nproc(parseRLimit(RLIMIT_NPROC, optarg, 1)); nsj->njc.set_rlimit_nproc(parseRLimit(RLIMIT_NPROC, optarg, 1));
nsj->njc.set_rlimit_nproc_type(nsjail::RLimit::VALUE); }
break; break;
case 0x0207: case 0x0207:
nsj->njc.set_rlimit_stack_type(parseRLimitType(RLIMIT_STACK, optarg));
if (nsj->njc.rlimit_stack_type() == nsjail::RLimit::VALUE) {
nsj->njc.set_rlimit_stack(parseRLimit(RLIMIT_STACK, optarg, 1)); nsj->njc.set_rlimit_stack(parseRLimit(RLIMIT_STACK, optarg, 1));
nsj->njc.set_rlimit_stack_type(nsjail::RLimit::VALUE); }
break; break;
case 0x0209: case 0x0209:
nsj->njc.set_rlimit_memlock_type(parseRLimitType(RLIMIT_MEMLOCK, optarg));
if (nsj->njc.rlimit_memlock_type() == nsjail::RLimit::VALUE) {
nsj->njc.set_rlimit_memlock(parseRLimit(RLIMIT_MEMLOCK, optarg, 1)); nsj->njc.set_rlimit_memlock(parseRLimit(RLIMIT_MEMLOCK, optarg, 1));
nsj->njc.set_rlimit_memlock_type(nsjail::RLimit::VALUE); }
break; break;
case 0x0210: case 0x0210:
nsj->njc.set_rlimit_rtprio_type(parseRLimitType(RLIMIT_RTPRIO, optarg));
if (nsj->njc.rlimit_rtprio_type() == nsjail::RLimit::VALUE) {
nsj->njc.set_rlimit_rtprio(parseRLimit(RLIMIT_RTPRIO, optarg, 1)); nsj->njc.set_rlimit_rtprio(parseRLimit(RLIMIT_RTPRIO, optarg, 1));
nsj->njc.set_rlimit_rtprio_type(nsjail::RLimit::VALUE); }
break; break;
case 0x0211: case 0x0211:
nsj->njc.set_rlimit_msgqueue_type(parseRLimitType(RLIMIT_MSGQUEUE, optarg));
if (nsj->njc.rlimit_msgqueue_type() == nsjail::RLimit::VALUE) {
nsj->njc.set_rlimit_msgqueue(parseRLimit(RLIMIT_MSGQUEUE, optarg, 1)); nsj->njc.set_rlimit_msgqueue(parseRLimit(RLIMIT_MSGQUEUE, optarg, 1));
nsj->njc.set_rlimit_msgqueue_type(nsjail::RLimit::VALUE); }
break; break;
case 0x0208: case 0x0208:
nsj->njc.set_disable_rl(true); nsj->njc.set_disable_rl(true);

1
cmdline.h
View File

@@ -31,6 +31,7 @@
namespace cmdline { namespace cmdline {
nsjail::RLimit parseRLimitType(int res, const char* optarg);
uint64_t parseRLimit(int res, const char* optarg, unsigned long mul); uint64_t parseRLimit(int res, const char* optarg, unsigned long mul);
void logParams(nsj_t* nsj); void logParams(nsj_t* nsj);
void addEnv(nsj_t* nsj, const std::string& env); void addEnv(nsj_t* nsj, const std::string& env);