cory/tildefriends
4
5
Fork 1
Code Issues 33 Pull Requests 1 Actions Releases 27 Wiki Activity

After a brief journey through namespaces and cgroups, rlimits seem to be an effective way to enforce most of the assurances I need.

Browse Source 
git-svn-id: https://www.unprompted.com/svn/projects/tildefriends/trunk@3205 ed5197a5-7fde-0310-b194-c3ffbd925b24
This commit is contained in:
Cory McWilliams 2016-04-16 19:04:15 +00:00
parent 105ecab472
commit 74af1d361c
1 changed files with 39 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
src/main.cpp
View File

@ -11,11 +11,49 @@
#if !defined (_WIN32) && !defined (__MACH__) #if !defined (_WIN32) && !defined (__MACH__)
#include <signal.h> #include <signal.h>
#include <sys/prctl.h> #include <sys/prctl.h>
#include <sys/resource.h>
#include <unistd.h> #include <unistd.h>
#endif #endif
v8::Platform* gPlatform = 0; v8::Platform* gPlatform = 0;
void shedPrivileges() {
#if !defined (_WIN32) && !defined (__MACH__)
struct rlimit zeroLimit;
zeroLimit.rlim_cur = 0;
zeroLimit.rlim_max = 0;
// RLIMIT_AS
// RLIMIT_CORE
// RLIMIT_CPU
// RLIMIT_DATA
// RLIMIT_FSIZE
// RLIMIT_RSS
// RLIMIT_RTPRIO
// RLIMIT_RTTIME
// RLIMIT_SIGPENDING
// RLIMIT_STACK
if (setrlimit(RLIMIT_FSIZE, &zeroLimit) != 0) {
perror("setrlimit(RLIMIT_FSIZE, {0, 0})");
}
if (setrlimit(RLIMIT_LOCKS, &zeroLimit) != 0) {
perror("setrlimit(RLIMIT_LOCKS, {0, 0})");
}
if (setrlimit(RLIMIT_MSGQUEUE, &zeroLimit) != 0) {
perror("setrlimit(RLIMIT_MSGQUEUE, {0, 0})");
}
/*
XXX
if (setrlimit(RLIMIT_NOFILE, &zeroLimit) != 0) {
perror("setrlimit(RLIMIT_NOFILE, {0, 0})");
}
*/
if (setrlimit(RLIMIT_NPROC, &zeroLimit) != 0) {
perror("setrlimit(RLIMIT_NPROC, {0, 0})");
}
#endif
}
int main(int argc, char* argv[]) { int main(int argc, char* argv[]) {
int result = 0; int result = 0;
@ -50,6 +88,7 @@ int main(int argc, char* argv[]) {
#endif #endif
Task task; Task task;
task.configureFromStdin(); task.configureFromStdin();
shedPrivileges();
task.activate(); task.activate();
task.run(); task.run();
} else { } else {