New Syscall: get rlimits of any process (update)

diff -uprN -X linux-2.6.13-rc6-vanilla/Documentation/dontdiff linux-2.6.13-rc6-getprlimit/include/linux/security.h linux-2.6.13-rc6-setprlimit/include/linux/security.h

include/linux/security.h +9 -0

@@ -591,6 +591,15 @@ struct swap_info_struct;
  *	@resource contains the resource whose limit is being set.
  *	@new_rlim contains the new limits for @resource.
  *	Return 0 if permission is granted.
+ * @task_setprlimit:
+ *	Check permission before setting the resource limits of process @p
+ *	for @resource to @new_rlim.  The old resource limit values can
+ *	be examined by dereferencing (p->signal->rlim + resource).
+ *	@p contains the task struct of the process whose resource limit is
+ *	being set.
+ *	@resource contains the resource whose limit is being set.
+ *	@new_rlim contains the new limits for @resource.
+ *	Return 0 if permission is granted.
  * @task_setscheduler:
  *	Check permission before setting scheduling policy and/or parameters of
  *	process @p based on @policy and @lp.

diff -uprN -X linux-2.6.13-rc6-vanilla/Documentation/dontdiff linux-2.6.13-rc6-getprlimit/kernel/sys.c linux-2.6.13-rc6-setprlimit/kernel/sys.c

kernel/sys.c +2 -0

@@ -1561,6 +1561,27 @@ asmlinkage long sys_old_getrlimit(unsign
 
 #endif
 
+static inline void check_process_timer(struct task_struct *task,
+				       unsigned int resource,

kernel/sys.c +24 -14

+		spin_lock_irq(&task->sighand->siglock);
+		set_process_cpu_timer(task, CPUCLOCK_PROF,
+				      &cputime, NULL);
+		spin_unlock_irq(&task->sighand->siglock);
+		if (!holds_lock)
+			read_unlock(&tasklist_lock);
+	}
+}
+
 asmlinkage long sys_setrlimit(unsigned int resource, struct rlimit __user *rlim)
 {
 	struct rlimit new_rlim, *old_rlim;

@@ -1570,8 +1591,8 @@ asmlinkage long sys_setrlimit(unsigned i
 		return -EINVAL;
 	if(copy_from_user(&new_rlim, rlim, sizeof(*rlim)))
 		return -EFAULT;
-       if (new_rlim.rlim_cur > new_rlim.rlim_max)
-               return -EINVAL;
+	if (new_rlim.rlim_cur > new_rlim.rlim_max)
+		return -EINVAL;
 	old_rlim = current->signal->rlim + resource;
 	if ((new_rlim.rlim_max > old_rlim->rlim_max) &&
 	    !capable(CAP_SYS_RESOURCE))

@@ -1587,18 +1608,7 @@ asmlinkage long sys_setrlimit(unsigned i
 	*old_rlim = new_rlim;
 	task_unlock(current->group_leader);
 
-	if (resource == RLIMIT_CPU && new_rlim.rlim_cur != RLIM_INFINITY &&
-	    (cputime_eq(current->signal->it_prof_expires, cputime_zero) ||
-	     new_rlim.rlim_cur <= cputime_to_secs(
-		     current->signal->it_prof_expires))) {
-		cputime_t cputime = secs_to_cputime(new_rlim.rlim_cur);
-		read_lock(&tasklist_lock);
-		spin_lock_irq(&current->sighand->siglock);
-		set_process_cpu_timer(current, CPUCLOCK_PROF,
-				      &cputime, NULL);
-		spin_unlock_irq(&current->sighand->siglock);
-		read_unlock(&tasklist_lock);
-	}
+	check_process_timer(current, resource, &new_rlim, 0);
 
 	return 0;
 }

@@ -1660,6 +1670,62 @@ out_nounlock:
 	return retval;
 }
 
+asmlinkage long sys_setprlimit(pid_t pid, unsigned int resource,
+			       struct rlimit __user *rlim)
+{
+	struct rlimit new_rlim, *old_rlim;
+	int retval;
+	task_t *p;
+
+	if (resource >= RLIM_NLIMITS)
+		return -EINVAL;
+	if (pid < 0)
+		return -EINVAL;
+	if (copy_from_user(&new_rlim, rlim, sizeof(*rlim)))

kernel/sys.c +11 -0

+	}
+	if (p) {
+		retval = -EPERM;
+		if (!prlim_check_perm(p))
+			goto out_unlock;
+
+		old_rlim = p->signal->rlim + resource;
+		if ((new_rlim.rlim_max > old_rlim->rlim_max) &&
+		    !capable(CAP_SYS_RESOURCE))
+			goto out_unlock;
+		if (resource == RLIMIT_NOFILE && new_rlim.rlim_max > NR_OPEN)

kernel/sys.c +13 -0

+
+		check_process_timer(p, resource, &new_rlim, 1);
+	}
+	if (pid == 0)
+		goto out_nounlock;
+
+out_unlock:
+	read_unlock(&tasklist_lock);
+
+out_nounlock:
+	return retval;
+}
+
 /*
  * It would make sense to put struct rusage in the task_struct,
  * except that would make the task_struct be *really big*.  After

diff -uprN -X linux-2.6.13-rc6-vanilla/Documentation/dontdiff linux-2.6.13-rc6-vanilla/kernel/sys.c linux-2.6.13-rc6-getprlimit/kernel/sys.c

kernel/sys.c +5 -0

@@ -1604,6 +1604,63 @@ asmlinkage long sys_setrlimit(unsigned i
 }
 
 /*
+ * As ptrace implies the ability to execute arbitrary code in the given
+ * process, which means that the calling process could obtain and set
+ * rlimits for that process without getprlimit/setprlimit anyways,
+ * we use the same permission checks as ptrace.
+ */

kernel/sys.c +20 -0

+
+asmlinkage long sys_getprlimit(pid_t pid, unsigned int resource,
+			       struct rlimit __user *rlim)
+{
+	struct rlimit value;
+	task_t *p;
+	int retval = -EINVAL;
+
+	if (resource >= RLIM_NLIMITS)
+		goto out_nounlock;
+
+	if (pid < 0)
+		goto out_nounlock;
+
+	retval = -ESRCH;
+	if (pid == 0) {
+		p = current;
+	} else {
+		read_lock(&tasklist_lock);
+		p = find_task_by_pid(pid);

Is there a realistic use case where this new system call is actually useful and solves something that cannot be solved without it?

Quoted 2 lines · Andi Kleen

Is there a realistic use case where this new system call is actually useful and solves something that cannot be solved without it?

As an example: It seems to be a common problem with numerous services to run out of available file descriptors. There are several workarounds to this problem, the most common seems to be increasing the systemwide max number of filedescriptors and restarting the service. If you google for e.g. 'linux "too many open files"' you get a bunch of mailing list support requests about that problem.

Also some documention for specific services show that there is a need to adjust rlimits per process at runtime, e.g.:
http://www.squid-cache.org/Doc/FAQ/FAQ-11.html#ss11.4
http://slacksite.com/apache/logging.html
http://staff.in2.hr/denis/oracle/10g1install_fedora3_en.html#n2

Quoted 5 lines

Also some documention for specific services show that there is a need to adjust rlimits per process at runtime, e.g.:
http://www.squid-cache.org/Doc/FAQ/FAQ-11.html#ss11.4
http://slacksite.com/apache/logging.html
http://staff.in2.hr/denis/oracle/10g1install_fedora3_en.html#n2

Perhaps those application authors should provide a management interface to do so within the soft limit range at least. Its not clear to me that growing the fd array on a process is even safe. Some programs do size arrays at startup after querying the rlimit data.

Perhaps those application authors should provide a management interface to do so within the soft limit range at least. Its not clear to me that growing the fd array on a process is even safe. Some programs do size arrays at startup after querying the rlimit data.

As an example: It seems to be a common problem with numerous services to run out of available file descriptors. There are several workarounds to this problem, the most common seems to be increasing the systemwide max number of filedescriptors and restarting the service. If you google for e.g. 'linux "too many open files"' you get a bunch of mailing list support requests about that problem.

Maybe the distros need to just increase the default FD limit to 1024. I hit this constantly with gtk-gnutella, if try to download a file that's available on more than 1024 hosts it will open sockets until it hits that limit then bomb out.

Quoted 4 lines · Lee Revell

Maybe the distros need to just increase the default FD limit to 1024. I hit this constantly with gtk-gnutella, if try to download a file that's available on more than 1024 hosts it will open sockets until it hits that limit then bomb out.

Sounds like a remarkably badly designed application. The author should perhaps look at the papers on tcp capture and efficiency unless they have a truely remarkably huge network pipe.

A search for a 200MB file tells you it's available on 2000 hosts, all of whom are on dialup.

Quoted 2 lines · Lee Revell

A search for a 200MB file tells you it's available on 2000 hosts, all of whom are on dialup.

What about the real world ?

(This resembles the behaviour of the ptrace system call.)