xref: /netbsd-src/sys/kern/kern_resource.c (revision 946379e7b37692fc43f68eb0d1c10daa0a7f3b6c)
1 /*	$NetBSD: kern_resource.c,v 1.174 2014/10/18 08:33:29 snj Exp $	*/
2 
3 /*-
4  * Copyright (c) 1982, 1986, 1991, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  * (c) UNIX System Laboratories, Inc.
7  * All or some portions of this file are derived from material licensed
8  * to the University of California by American Telephone and Telegraph
9  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
10  * the permission of UNIX System Laboratories, Inc.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  * 3. Neither the name of the University nor the names of its contributors
21  *    may be used to endorse or promote products derived from this software
22  *    without specific prior written permission.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34  * SUCH DAMAGE.
35  *
36  *	@(#)kern_resource.c	8.8 (Berkeley) 2/14/95
37  */
38 
39 #include <sys/cdefs.h>
40 __KERNEL_RCSID(0, "$NetBSD: kern_resource.c,v 1.174 2014/10/18 08:33:29 snj Exp $");
41 
42 #include <sys/param.h>
43 #include <sys/systm.h>
44 #include <sys/kernel.h>
45 #include <sys/file.h>
46 #include <sys/resourcevar.h>
47 #include <sys/kmem.h>
48 #include <sys/namei.h>
49 #include <sys/pool.h>
50 #include <sys/proc.h>
51 #include <sys/sysctl.h>
52 #include <sys/timevar.h>
53 #include <sys/kauth.h>
54 #include <sys/atomic.h>
55 #include <sys/mount.h>
56 #include <sys/syscallargs.h>
57 #include <sys/atomic.h>
58 
59 #include <uvm/uvm_extern.h>
60 
61 /*
62  * Maximum process data and stack limits.
63  * They are variables so they are patchable.
64  */
65 rlim_t			maxdmap = MAXDSIZ;
66 rlim_t			maxsmap = MAXSSIZ;
67 
68 static pool_cache_t	plimit_cache	__read_mostly;
69 static pool_cache_t	pstats_cache	__read_mostly;
70 
71 static kauth_listener_t	resource_listener;
72 static struct sysctllog	*proc_sysctllog;
73 
74 static int	donice(struct lwp *, struct proc *, int);
75 static void	sysctl_proc_setup(void);
76 
77 static int
78 resource_listener_cb(kauth_cred_t cred, kauth_action_t action, void *cookie,
79     void *arg0, void *arg1, void *arg2, void *arg3)
80 {
81 	struct proc *p;
82 	int result;
83 
84 	result = KAUTH_RESULT_DEFER;
85 	p = arg0;
86 
87 	switch (action) {
88 	case KAUTH_PROCESS_NICE:
89 		if (kauth_cred_geteuid(cred) != kauth_cred_geteuid(p->p_cred) &&
90 		    kauth_cred_getuid(cred) != kauth_cred_geteuid(p->p_cred)) {
91 			break;
92 		}
93 
94 		if ((u_long)arg1 >= p->p_nice)
95 			result = KAUTH_RESULT_ALLOW;
96 
97 		break;
98 
99 	case KAUTH_PROCESS_RLIMIT: {
100 		enum kauth_process_req req;
101 
102 		req = (enum kauth_process_req)(unsigned long)arg1;
103 
104 		switch (req) {
105 		case KAUTH_REQ_PROCESS_RLIMIT_GET:
106 			result = KAUTH_RESULT_ALLOW;
107 			break;
108 
109 		case KAUTH_REQ_PROCESS_RLIMIT_SET: {
110 			struct rlimit *new_rlimit;
111 			u_long which;
112 
113 			if ((p != curlwp->l_proc) &&
114 			    (proc_uidmatch(cred, p->p_cred) != 0))
115 				break;
116 
117 			new_rlimit = arg2;
118 			which = (u_long)arg3;
119 
120 			if (new_rlimit->rlim_max <= p->p_rlimit[which].rlim_max)
121 				result = KAUTH_RESULT_ALLOW;
122 
123 			break;
124 			}
125 
126 		default:
127 			break;
128 		}
129 
130 		break;
131 	}
132 
133 	default:
134 		break;
135 	}
136 
137 	return result;
138 }
139 
140 void
141 resource_init(void)
142 {
143 
144 	plimit_cache = pool_cache_init(sizeof(struct plimit), 0, 0, 0,
145 	    "plimitpl", NULL, IPL_NONE, NULL, NULL, NULL);
146 	pstats_cache = pool_cache_init(sizeof(struct pstats), 0, 0, 0,
147 	    "pstatspl", NULL, IPL_NONE, NULL, NULL, NULL);
148 
149 	resource_listener = kauth_listen_scope(KAUTH_SCOPE_PROCESS,
150 	    resource_listener_cb, NULL);
151 
152 	sysctl_proc_setup();
153 }
154 
155 /*
156  * Resource controls and accounting.
157  */
158 
159 int
160 sys_getpriority(struct lwp *l, const struct sys_getpriority_args *uap,
161     register_t *retval)
162 {
163 	/* {
164 		syscallarg(int) which;
165 		syscallarg(id_t) who;
166 	} */
167 	struct proc *curp = l->l_proc, *p;
168 	id_t who = SCARG(uap, who);
169 	int low = NZERO + PRIO_MAX + 1;
170 
171 	mutex_enter(proc_lock);
172 	switch (SCARG(uap, which)) {
173 	case PRIO_PROCESS:
174 		p = who ? proc_find(who) : curp;
175 		if (p != NULL)
176 			low = p->p_nice;
177 		break;
178 
179 	case PRIO_PGRP: {
180 		struct pgrp *pg;
181 
182 		if (who == 0)
183 			pg = curp->p_pgrp;
184 		else if ((pg = pgrp_find(who)) == NULL)
185 			break;
186 		LIST_FOREACH(p, &pg->pg_members, p_pglist) {
187 			if (p->p_nice < low)
188 				low = p->p_nice;
189 		}
190 		break;
191 	}
192 
193 	case PRIO_USER:
194 		if (who == 0)
195 			who = (int)kauth_cred_geteuid(l->l_cred);
196 		PROCLIST_FOREACH(p, &allproc) {
197 			mutex_enter(p->p_lock);
198 			if (kauth_cred_geteuid(p->p_cred) ==
199 			    (uid_t)who && p->p_nice < low)
200 				low = p->p_nice;
201 			mutex_exit(p->p_lock);
202 		}
203 		break;
204 
205 	default:
206 		mutex_exit(proc_lock);
207 		return EINVAL;
208 	}
209 	mutex_exit(proc_lock);
210 
211 	if (low == NZERO + PRIO_MAX + 1) {
212 		return ESRCH;
213 	}
214 	*retval = low - NZERO;
215 	return 0;
216 }
217 
218 int
219 sys_setpriority(struct lwp *l, const struct sys_setpriority_args *uap,
220     register_t *retval)
221 {
222 	/* {
223 		syscallarg(int) which;
224 		syscallarg(id_t) who;
225 		syscallarg(int) prio;
226 	} */
227 	struct proc *curp = l->l_proc, *p;
228 	id_t who = SCARG(uap, who);
229 	int found = 0, error = 0;
230 
231 	mutex_enter(proc_lock);
232 	switch (SCARG(uap, which)) {
233 	case PRIO_PROCESS:
234 		p = who ? proc_find(who) : curp;
235 		if (p != NULL) {
236 			mutex_enter(p->p_lock);
237 			found++;
238 			error = donice(l, p, SCARG(uap, prio));
239 			mutex_exit(p->p_lock);
240 		}
241 		break;
242 
243 	case PRIO_PGRP: {
244 		struct pgrp *pg;
245 
246 		if (who == 0)
247 			pg = curp->p_pgrp;
248 		else if ((pg = pgrp_find(who)) == NULL)
249 			break;
250 		LIST_FOREACH(p, &pg->pg_members, p_pglist) {
251 			mutex_enter(p->p_lock);
252 			found++;
253 			error = donice(l, p, SCARG(uap, prio));
254 			mutex_exit(p->p_lock);
255 			if (error)
256 				break;
257 		}
258 		break;
259 	}
260 
261 	case PRIO_USER:
262 		if (who == 0)
263 			who = (int)kauth_cred_geteuid(l->l_cred);
264 		PROCLIST_FOREACH(p, &allproc) {
265 			mutex_enter(p->p_lock);
266 			if (kauth_cred_geteuid(p->p_cred) ==
267 			    (uid_t)SCARG(uap, who)) {
268 				found++;
269 				error = donice(l, p, SCARG(uap, prio));
270 			}
271 			mutex_exit(p->p_lock);
272 			if (error)
273 				break;
274 		}
275 		break;
276 
277 	default:
278 		mutex_exit(proc_lock);
279 		return EINVAL;
280 	}
281 	mutex_exit(proc_lock);
282 
283 	return (found == 0) ? ESRCH : error;
284 }
285 
286 /*
287  * Renice a process.
288  *
289  * Call with the target process' credentials locked.
290  */
291 static int
292 donice(struct lwp *l, struct proc *chgp, int n)
293 {
294 	kauth_cred_t cred = l->l_cred;
295 
296 	KASSERT(mutex_owned(chgp->p_lock));
297 
298 	if (kauth_cred_geteuid(cred) && kauth_cred_getuid(cred) &&
299 	    kauth_cred_geteuid(cred) != kauth_cred_geteuid(chgp->p_cred) &&
300 	    kauth_cred_getuid(cred) != kauth_cred_geteuid(chgp->p_cred))
301 		return EPERM;
302 
303 	if (n > PRIO_MAX) {
304 		n = PRIO_MAX;
305 	}
306 	if (n < PRIO_MIN) {
307 		n = PRIO_MIN;
308 	}
309 	n += NZERO;
310 
311 	if (kauth_authorize_process(cred, KAUTH_PROCESS_NICE, chgp,
312 	    KAUTH_ARG(n), NULL, NULL)) {
313 		return EACCES;
314 	}
315 
316 	sched_nice(chgp, n);
317 	return 0;
318 }
319 
320 int
321 sys_setrlimit(struct lwp *l, const struct sys_setrlimit_args *uap,
322     register_t *retval)
323 {
324 	/* {
325 		syscallarg(int) which;
326 		syscallarg(const struct rlimit *) rlp;
327 	} */
328 	int error, which = SCARG(uap, which);
329 	struct rlimit alim;
330 
331 	error = copyin(SCARG(uap, rlp), &alim, sizeof(struct rlimit));
332 	if (error) {
333 		return error;
334 	}
335 	return dosetrlimit(l, l->l_proc, which, &alim);
336 }
337 
338 int
339 dosetrlimit(struct lwp *l, struct proc *p, int which, struct rlimit *limp)
340 {
341 	struct rlimit *alimp;
342 	int error;
343 
344 	if ((u_int)which >= RLIM_NLIMITS)
345 		return EINVAL;
346 
347 	if (limp->rlim_cur > limp->rlim_max) {
348 		/*
349 		 * This is programming error. According to SUSv2, we should
350 		 * return error in this case.
351 		 */
352 		return EINVAL;
353 	}
354 
355 	alimp = &p->p_rlimit[which];
356 	/* if we don't change the value, no need to limcopy() */
357 	if (limp->rlim_cur == alimp->rlim_cur &&
358 	    limp->rlim_max == alimp->rlim_max)
359 		return 0;
360 
361 	error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_RLIMIT,
362 	    p, KAUTH_ARG(KAUTH_REQ_PROCESS_RLIMIT_SET), limp, KAUTH_ARG(which));
363 	if (error)
364 		return error;
365 
366 	lim_privatise(p);
367 	/* p->p_limit is now unchangeable */
368 	alimp = &p->p_rlimit[which];
369 
370 	switch (which) {
371 
372 	case RLIMIT_DATA:
373 		if (limp->rlim_cur > maxdmap)
374 			limp->rlim_cur = maxdmap;
375 		if (limp->rlim_max > maxdmap)
376 			limp->rlim_max = maxdmap;
377 		break;
378 
379 	case RLIMIT_STACK:
380 		if (limp->rlim_cur > maxsmap)
381 			limp->rlim_cur = maxsmap;
382 		if (limp->rlim_max > maxsmap)
383 			limp->rlim_max = maxsmap;
384 
385 		/*
386 		 * Return EINVAL if the new stack size limit is lower than
387 		 * current usage. Otherwise, the process would get SIGSEGV the
388 		 * moment it would try to access anything on its current stack.
389 		 * This conforms to SUSv2.
390 		 */
391 		if (limp->rlim_cur < p->p_vmspace->vm_ssize * PAGE_SIZE ||
392 		    limp->rlim_max < p->p_vmspace->vm_ssize * PAGE_SIZE) {
393 			return EINVAL;
394 		}
395 
396 		/*
397 		 * Stack is allocated to the max at exec time with
398 		 * only "rlim_cur" bytes accessible (In other words,
399 		 * allocates stack dividing two contiguous regions at
400 		 * "rlim_cur" bytes boundary).
401 		 *
402 		 * Since allocation is done in terms of page, roundup
403 		 * "rlim_cur" (otherwise, contiguous regions
404 		 * overlap).  If stack limit is going up make more
405 		 * accessible, if going down make inaccessible.
406 		 */
407 		limp->rlim_cur = round_page(limp->rlim_cur);
408 		if (limp->rlim_cur != alimp->rlim_cur) {
409 			vaddr_t addr;
410 			vsize_t size;
411 			vm_prot_t prot;
412 			char *base, *tmp;
413 
414 			base = p->p_vmspace->vm_minsaddr;
415 			if (limp->rlim_cur > alimp->rlim_cur) {
416 				prot = VM_PROT_READ | VM_PROT_WRITE;
417 				size = limp->rlim_cur - alimp->rlim_cur;
418 				tmp = STACK_GROW(base, alimp->rlim_cur);
419 			} else {
420 				prot = VM_PROT_NONE;
421 				size = alimp->rlim_cur - limp->rlim_cur;
422 				tmp = STACK_GROW(base, limp->rlim_cur);
423 			}
424 			addr = (vaddr_t)STACK_ALLOC(tmp, size);
425 			(void) uvm_map_protect(&p->p_vmspace->vm_map,
426 			    addr, addr + size, prot, false);
427 		}
428 		break;
429 
430 	case RLIMIT_NOFILE:
431 		if (limp->rlim_cur > maxfiles)
432 			limp->rlim_cur = maxfiles;
433 		if (limp->rlim_max > maxfiles)
434 			limp->rlim_max = maxfiles;
435 		break;
436 
437 	case RLIMIT_NPROC:
438 		if (limp->rlim_cur > maxproc)
439 			limp->rlim_cur = maxproc;
440 		if (limp->rlim_max > maxproc)
441 			limp->rlim_max = maxproc;
442 		break;
443 
444 	case RLIMIT_NTHR:
445 		if (limp->rlim_cur > maxlwp)
446 			limp->rlim_cur = maxlwp;
447 		if (limp->rlim_max > maxlwp)
448 			limp->rlim_max = maxlwp;
449 		break;
450 	}
451 
452 	mutex_enter(&p->p_limit->pl_lock);
453 	*alimp = *limp;
454 	mutex_exit(&p->p_limit->pl_lock);
455 	return 0;
456 }
457 
458 int
459 sys_getrlimit(struct lwp *l, const struct sys_getrlimit_args *uap,
460     register_t *retval)
461 {
462 	/* {
463 		syscallarg(int) which;
464 		syscallarg(struct rlimit *) rlp;
465 	} */
466 	struct proc *p = l->l_proc;
467 	int which = SCARG(uap, which);
468 	struct rlimit rl;
469 
470 	if ((u_int)which >= RLIM_NLIMITS)
471 		return EINVAL;
472 
473 	mutex_enter(p->p_lock);
474 	memcpy(&rl, &p->p_rlimit[which], sizeof(rl));
475 	mutex_exit(p->p_lock);
476 
477 	return copyout(&rl, SCARG(uap, rlp), sizeof(rl));
478 }
479 
480 /*
481  * Transform the running time and tick information in proc p into user,
482  * system, and interrupt time usage.
483  *
484  * Should be called with p->p_lock held unless called from exit1().
485  */
486 void
487 calcru(struct proc *p, struct timeval *up, struct timeval *sp,
488     struct timeval *ip, struct timeval *rp)
489 {
490 	uint64_t u, st, ut, it, tot;
491 	struct lwp *l;
492 	struct bintime tm;
493 	struct timeval tv;
494 
495 	KASSERT(p->p_stat == SDEAD || mutex_owned(p->p_lock));
496 
497 	mutex_spin_enter(&p->p_stmutex);
498 	st = p->p_sticks;
499 	ut = p->p_uticks;
500 	it = p->p_iticks;
501 	mutex_spin_exit(&p->p_stmutex);
502 
503 	tm = p->p_rtime;
504 
505 	LIST_FOREACH(l, &p->p_lwps, l_sibling) {
506 		lwp_lock(l);
507 		bintime_add(&tm, &l->l_rtime);
508 		if ((l->l_pflag & LP_RUNNING) != 0) {
509 			struct bintime diff;
510 			/*
511 			 * Adjust for the current time slice.  This is
512 			 * actually fairly important since the error
513 			 * here is on the order of a time quantum,
514 			 * which is much greater than the sampling
515 			 * error.
516 			 */
517 			binuptime(&diff);
518 			bintime_sub(&diff, &l->l_stime);
519 			bintime_add(&tm, &diff);
520 		}
521 		lwp_unlock(l);
522 	}
523 
524 	tot = st + ut + it;
525 	bintime2timeval(&tm, &tv);
526 	u = (uint64_t)tv.tv_sec * 1000000ul + tv.tv_usec;
527 
528 	if (tot == 0) {
529 		/* No ticks, so can't use to share time out, split 50-50 */
530 		st = ut = u / 2;
531 	} else {
532 		st = (u * st) / tot;
533 		ut = (u * ut) / tot;
534 	}
535 	if (sp != NULL) {
536 		sp->tv_sec = st / 1000000;
537 		sp->tv_usec = st % 1000000;
538 	}
539 	if (up != NULL) {
540 		up->tv_sec = ut / 1000000;
541 		up->tv_usec = ut % 1000000;
542 	}
543 	if (ip != NULL) {
544 		if (it != 0)
545 			it = (u * it) / tot;
546 		ip->tv_sec = it / 1000000;
547 		ip->tv_usec = it % 1000000;
548 	}
549 	if (rp != NULL) {
550 		*rp = tv;
551 	}
552 }
553 
554 int
555 sys___getrusage50(struct lwp *l, const struct sys___getrusage50_args *uap,
556     register_t *retval)
557 {
558 	/* {
559 		syscallarg(int) who;
560 		syscallarg(struct rusage *) rusage;
561 	} */
562 	int error;
563 	struct rusage ru;
564 	struct proc *p = l->l_proc;
565 
566 	error = getrusage1(p, SCARG(uap, who), &ru);
567 	if (error != 0)
568 		return error;
569 
570 	return copyout(&ru, SCARG(uap, rusage), sizeof(ru));
571 }
572 
573 int
574 getrusage1(struct proc *p, int who, struct rusage *ru) {
575 
576 	switch (who) {
577 	case RUSAGE_SELF:
578 		mutex_enter(p->p_lock);
579 		memcpy(ru, &p->p_stats->p_ru, sizeof(*ru));
580 		calcru(p, &ru->ru_utime, &ru->ru_stime, NULL, NULL);
581 		rulwps(p, ru);
582 		mutex_exit(p->p_lock);
583 		break;
584 	case RUSAGE_CHILDREN:
585 		mutex_enter(p->p_lock);
586 		memcpy(ru, &p->p_stats->p_cru, sizeof(*ru));
587 		mutex_exit(p->p_lock);
588 		break;
589 	default:
590 		return EINVAL;
591 	}
592 
593 	return 0;
594 }
595 
596 void
597 ruadd(struct rusage *ru, struct rusage *ru2)
598 {
599 	long *ip, *ip2;
600 	int i;
601 
602 	timeradd(&ru->ru_utime, &ru2->ru_utime, &ru->ru_utime);
603 	timeradd(&ru->ru_stime, &ru2->ru_stime, &ru->ru_stime);
604 	if (ru->ru_maxrss < ru2->ru_maxrss)
605 		ru->ru_maxrss = ru2->ru_maxrss;
606 	ip = &ru->ru_first; ip2 = &ru2->ru_first;
607 	for (i = &ru->ru_last - &ru->ru_first; i >= 0; i--)
608 		*ip++ += *ip2++;
609 }
610 
611 void
612 rulwps(proc_t *p, struct rusage *ru)
613 {
614 	lwp_t *l;
615 
616 	KASSERT(mutex_owned(p->p_lock));
617 
618 	LIST_FOREACH(l, &p->p_lwps, l_sibling) {
619 		ruadd(ru, &l->l_ru);
620 		ru->ru_nvcsw += (l->l_ncsw - l->l_nivcsw);
621 		ru->ru_nivcsw += l->l_nivcsw;
622 	}
623 }
624 
625 /*
626  * lim_copy: make a copy of the plimit structure.
627  *
628  * We use copy-on-write after fork, and copy when a limit is changed.
629  */
630 struct plimit *
631 lim_copy(struct plimit *lim)
632 {
633 	struct plimit *newlim;
634 	char *corename;
635 	size_t alen, len;
636 
637 	newlim = pool_cache_get(plimit_cache, PR_WAITOK);
638 	mutex_init(&newlim->pl_lock, MUTEX_DEFAULT, IPL_NONE);
639 	newlim->pl_writeable = false;
640 	newlim->pl_refcnt = 1;
641 	newlim->pl_sv_limit = NULL;
642 
643 	mutex_enter(&lim->pl_lock);
644 	memcpy(newlim->pl_rlimit, lim->pl_rlimit,
645 	    sizeof(struct rlimit) * RLIM_NLIMITS);
646 
647 	/*
648 	 * Note: the common case is a use of default core name.
649 	 */
650 	alen = 0;
651 	corename = NULL;
652 	for (;;) {
653 		if (lim->pl_corename == defcorename) {
654 			newlim->pl_corename = defcorename;
655 			newlim->pl_cnlen = 0;
656 			break;
657 		}
658 		len = lim->pl_cnlen;
659 		if (len == alen) {
660 			newlim->pl_corename = corename;
661 			newlim->pl_cnlen = len;
662 			memcpy(corename, lim->pl_corename, len);
663 			corename = NULL;
664 			break;
665 		}
666 		mutex_exit(&lim->pl_lock);
667 		if (corename) {
668 			kmem_free(corename, alen);
669 		}
670 		alen = len;
671 		corename = kmem_alloc(alen, KM_SLEEP);
672 		mutex_enter(&lim->pl_lock);
673 	}
674 	mutex_exit(&lim->pl_lock);
675 
676 	if (corename) {
677 		kmem_free(corename, alen);
678 	}
679 	return newlim;
680 }
681 
682 void
683 lim_addref(struct plimit *lim)
684 {
685 	atomic_inc_uint(&lim->pl_refcnt);
686 }
687 
688 /*
689  * lim_privatise: give a process its own private plimit structure.
690  */
691 void
692 lim_privatise(proc_t *p)
693 {
694 	struct plimit *lim = p->p_limit, *newlim;
695 
696 	if (lim->pl_writeable) {
697 		return;
698 	}
699 
700 	newlim = lim_copy(lim);
701 
702 	mutex_enter(p->p_lock);
703 	if (p->p_limit->pl_writeable) {
704 		/* Other thread won the race. */
705 		mutex_exit(p->p_lock);
706 		lim_free(newlim);
707 		return;
708 	}
709 
710 	/*
711 	 * Since p->p_limit can be accessed without locked held,
712 	 * old limit structure must not be deleted yet.
713 	 */
714 	newlim->pl_sv_limit = p->p_limit;
715 	newlim->pl_writeable = true;
716 	p->p_limit = newlim;
717 	mutex_exit(p->p_lock);
718 }
719 
720 void
721 lim_setcorename(proc_t *p, char *name, size_t len)
722 {
723 	struct plimit *lim;
724 	char *oname;
725 	size_t olen;
726 
727 	lim_privatise(p);
728 	lim = p->p_limit;
729 
730 	mutex_enter(&lim->pl_lock);
731 	oname = lim->pl_corename;
732 	olen = lim->pl_cnlen;
733 	lim->pl_corename = name;
734 	lim->pl_cnlen = len;
735 	mutex_exit(&lim->pl_lock);
736 
737 	if (oname != defcorename) {
738 		kmem_free(oname, olen);
739 	}
740 }
741 
742 void
743 lim_free(struct plimit *lim)
744 {
745 	struct plimit *sv_lim;
746 
747 	do {
748 		if (atomic_dec_uint_nv(&lim->pl_refcnt) > 0) {
749 			return;
750 		}
751 		if (lim->pl_corename != defcorename) {
752 			kmem_free(lim->pl_corename, lim->pl_cnlen);
753 		}
754 		sv_lim = lim->pl_sv_limit;
755 		mutex_destroy(&lim->pl_lock);
756 		pool_cache_put(plimit_cache, lim);
757 	} while ((lim = sv_lim) != NULL);
758 }
759 
760 struct pstats *
761 pstatscopy(struct pstats *ps)
762 {
763 	struct pstats *nps;
764 	size_t len;
765 
766 	nps = pool_cache_get(pstats_cache, PR_WAITOK);
767 
768 	len = (char *)&nps->pstat_endzero - (char *)&nps->pstat_startzero;
769 	memset(&nps->pstat_startzero, 0, len);
770 
771 	len = (char *)&nps->pstat_endcopy - (char *)&nps->pstat_startcopy;
772 	memcpy(&nps->pstat_startcopy, &ps->pstat_startcopy, len);
773 
774 	return nps;
775 }
776 
777 void
778 pstatsfree(struct pstats *ps)
779 {
780 
781 	pool_cache_put(pstats_cache, ps);
782 }
783 
784 /*
785  * sysctl_proc_findproc: a routine for sysctl proc subtree helpers that
786  * need to pick a valid process by PID.
787  *
788  * => Hold a reference on the process, on success.
789  */
790 static int
791 sysctl_proc_findproc(lwp_t *l, pid_t pid, proc_t **p2)
792 {
793 	proc_t *p;
794 	int error;
795 
796 	if (pid == PROC_CURPROC) {
797 		p = l->l_proc;
798 	} else {
799 		mutex_enter(proc_lock);
800 		p = proc_find(pid);
801 		if (p == NULL) {
802 			mutex_exit(proc_lock);
803 			return ESRCH;
804 		}
805 	}
806 	error = rw_tryenter(&p->p_reflock, RW_READER) ? 0 : EBUSY;
807 	if (pid != PROC_CURPROC) {
808 		mutex_exit(proc_lock);
809 	}
810 	*p2 = p;
811 	return error;
812 }
813 
814 /*
815  * sysctl_proc_corename: helper routine to get or set the core file name
816  * for a process specified by PID.
817  */
818 static int
819 sysctl_proc_corename(SYSCTLFN_ARGS)
820 {
821 	struct proc *p;
822 	struct plimit *lim;
823 	char *cnbuf, *cname;
824 	struct sysctlnode node;
825 	size_t len;
826 	int error;
827 
828 	/* First, validate the request. */
829 	if (namelen != 0 || name[-1] != PROC_PID_CORENAME)
830 		return EINVAL;
831 
832 	/* Find the process.  Hold a reference (p_reflock), if found. */
833 	error = sysctl_proc_findproc(l, (pid_t)name[-2], &p);
834 	if (error)
835 		return error;
836 
837 	/* XXX-elad */
838 	error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_CANSEE, p,
839 	    KAUTH_ARG(KAUTH_REQ_PROCESS_CANSEE_ENTRY), NULL, NULL);
840 	if (error) {
841 		rw_exit(&p->p_reflock);
842 		return error;
843 	}
844 
845 	cnbuf = PNBUF_GET();
846 
847 	if (oldp) {
848 		/* Get case: copy the core name into the buffer. */
849 		error = kauth_authorize_process(l->l_cred,
850 		    KAUTH_PROCESS_CORENAME, p,
851 		    KAUTH_ARG(KAUTH_REQ_PROCESS_CORENAME_GET), NULL, NULL);
852 		if (error) {
853 			goto done;
854 		}
855 		lim = p->p_limit;
856 		mutex_enter(&lim->pl_lock);
857 		strlcpy(cnbuf, lim->pl_corename, MAXPATHLEN);
858 		mutex_exit(&lim->pl_lock);
859 	}
860 
861 	node = *rnode;
862 	node.sysctl_data = cnbuf;
863 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
864 
865 	/* Return if error, or if caller is only getting the core name. */
866 	if (error || newp == NULL) {
867 		goto done;
868 	}
869 
870 	/*
871 	 * Set case.  Check permission and then validate new core name.
872 	 * It must be either "core", "/core", or end in ".core".
873 	 */
874 	error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_CORENAME,
875 	    p, KAUTH_ARG(KAUTH_REQ_PROCESS_CORENAME_SET), cnbuf, NULL);
876 	if (error) {
877 		goto done;
878 	}
879 	len = strlen(cnbuf);
880 	if ((len < 4 || strcmp(cnbuf + len - 4, "core") != 0) ||
881 	    (len > 4 && cnbuf[len - 5] != '/' && cnbuf[len - 5] != '.')) {
882 		error = EINVAL;
883 		goto done;
884 	}
885 
886 	/* Allocate, copy and set the new core name for plimit structure. */
887 	cname = kmem_alloc(++len, KM_NOSLEEP);
888 	if (cname == NULL) {
889 		error = ENOMEM;
890 		goto done;
891 	}
892 	memcpy(cname, cnbuf, len);
893 	lim_setcorename(p, cname, len);
894 done:
895 	rw_exit(&p->p_reflock);
896 	PNBUF_PUT(cnbuf);
897 	return error;
898 }
899 
900 /*
901  * sysctl_proc_stop: helper routine for checking/setting the stop flags.
902  */
903 static int
904 sysctl_proc_stop(SYSCTLFN_ARGS)
905 {
906 	struct proc *p;
907 	int isset, flag, error = 0;
908 	struct sysctlnode node;
909 
910 	if (namelen != 0)
911 		return EINVAL;
912 
913 	/* Find the process.  Hold a reference (p_reflock), if found. */
914 	error = sysctl_proc_findproc(l, (pid_t)name[-2], &p);
915 	if (error)
916 		return error;
917 
918 	/* XXX-elad */
919 	error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_CANSEE, p,
920 	    KAUTH_ARG(KAUTH_REQ_PROCESS_CANSEE_ENTRY), NULL, NULL);
921 	if (error) {
922 		goto out;
923 	}
924 
925 	/* Determine the flag. */
926 	switch (rnode->sysctl_num) {
927 	case PROC_PID_STOPFORK:
928 		flag = PS_STOPFORK;
929 		break;
930 	case PROC_PID_STOPEXEC:
931 		flag = PS_STOPEXEC;
932 		break;
933 	case PROC_PID_STOPEXIT:
934 		flag = PS_STOPEXIT;
935 		break;
936 	default:
937 		error = EINVAL;
938 		goto out;
939 	}
940 	isset = (p->p_flag & flag) ? 1 : 0;
941 	node = *rnode;
942 	node.sysctl_data = &isset;
943 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
944 
945 	/* Return if error, or if callers is only getting the flag. */
946 	if (error || newp == NULL) {
947 		goto out;
948 	}
949 
950 	/* Check if caller can set the flags. */
951 	error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_STOPFLAG,
952 	    p, KAUTH_ARG(flag), NULL, NULL);
953 	if (error) {
954 		goto out;
955 	}
956 	mutex_enter(p->p_lock);
957 	if (isset) {
958 		p->p_sflag |= flag;
959 	} else {
960 		p->p_sflag &= ~flag;
961 	}
962 	mutex_exit(p->p_lock);
963 out:
964 	rw_exit(&p->p_reflock);
965 	return error;
966 }
967 
968 /*
969  * sysctl_proc_plimit: helper routine to get/set rlimits of a process.
970  */
971 static int
972 sysctl_proc_plimit(SYSCTLFN_ARGS)
973 {
974 	struct proc *p;
975 	u_int limitno;
976 	int which, error = 0;
977         struct rlimit alim;
978 	struct sysctlnode node;
979 
980 	if (namelen != 0)
981 		return EINVAL;
982 
983 	which = name[-1];
984 	if (which != PROC_PID_LIMIT_TYPE_SOFT &&
985 	    which != PROC_PID_LIMIT_TYPE_HARD)
986 		return EINVAL;
987 
988 	limitno = name[-2] - 1;
989 	if (limitno >= RLIM_NLIMITS)
990 		return EINVAL;
991 
992 	if (name[-3] != PROC_PID_LIMIT)
993 		return EINVAL;
994 
995 	/* Find the process.  Hold a reference (p_reflock), if found. */
996 	error = sysctl_proc_findproc(l, (pid_t)name[-4], &p);
997 	if (error)
998 		return error;
999 
1000 	/* XXX-elad */
1001 	error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_CANSEE, p,
1002 	    KAUTH_ARG(KAUTH_REQ_PROCESS_CANSEE_ENTRY), NULL, NULL);
1003 	if (error)
1004 		goto out;
1005 
1006 	/* Check if caller can retrieve the limits. */
1007 	if (newp == NULL) {
1008 		error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_RLIMIT,
1009 		    p, KAUTH_ARG(KAUTH_REQ_PROCESS_RLIMIT_GET), &alim,
1010 		    KAUTH_ARG(which));
1011 		if (error)
1012 			goto out;
1013 	}
1014 
1015 	/* Retrieve the limits. */
1016 	node = *rnode;
1017 	memcpy(&alim, &p->p_rlimit[limitno], sizeof(alim));
1018 	if (which == PROC_PID_LIMIT_TYPE_HARD) {
1019 		node.sysctl_data = &alim.rlim_max;
1020 	} else {
1021 		node.sysctl_data = &alim.rlim_cur;
1022 	}
1023 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
1024 
1025 	/* Return if error, or if we are only retrieving the limits. */
1026 	if (error || newp == NULL) {
1027 		goto out;
1028 	}
1029 	error = dosetrlimit(l, p, limitno, &alim);
1030 out:
1031 	rw_exit(&p->p_reflock);
1032 	return error;
1033 }
1034 
1035 /*
1036  * Setup sysctl nodes.
1037  */
1038 static void
1039 sysctl_proc_setup(void)
1040 {
1041 
1042 	sysctl_createv(&proc_sysctllog, 0, NULL, NULL,
1043 		       CTLFLAG_PERMANENT|CTLFLAG_ANYNUMBER,
1044 		       CTLTYPE_NODE, "curproc",
1045 		       SYSCTL_DESCR("Per-process settings"),
1046 		       NULL, 0, NULL, 0,
1047 		       CTL_PROC, PROC_CURPROC, CTL_EOL);
1048 
1049 	sysctl_createv(&proc_sysctllog, 0, NULL, NULL,
1050 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE|CTLFLAG_ANYWRITE,
1051 		       CTLTYPE_STRING, "corename",
1052 		       SYSCTL_DESCR("Core file name"),
1053 		       sysctl_proc_corename, 0, NULL, MAXPATHLEN,
1054 		       CTL_PROC, PROC_CURPROC, PROC_PID_CORENAME, CTL_EOL);
1055 	sysctl_createv(&proc_sysctllog, 0, NULL, NULL,
1056 		       CTLFLAG_PERMANENT,
1057 		       CTLTYPE_NODE, "rlimit",
1058 		       SYSCTL_DESCR("Process limits"),
1059 		       NULL, 0, NULL, 0,
1060 		       CTL_PROC, PROC_CURPROC, PROC_PID_LIMIT, CTL_EOL);
1061 
1062 #define create_proc_plimit(s, n) do {					\
1063 	sysctl_createv(&proc_sysctllog, 0, NULL, NULL,			\
1064 		       CTLFLAG_PERMANENT,				\
1065 		       CTLTYPE_NODE, s,					\
1066 		       SYSCTL_DESCR("Process " s " limits"),		\
1067 		       NULL, 0, NULL, 0,				\
1068 		       CTL_PROC, PROC_CURPROC, PROC_PID_LIMIT, n,	\
1069 		       CTL_EOL);					\
1070 	sysctl_createv(&proc_sysctllog, 0, NULL, NULL,			\
1071 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE|CTLFLAG_ANYWRITE, \
1072 		       CTLTYPE_QUAD, "soft",				\
1073 		       SYSCTL_DESCR("Process soft " s " limit"),	\
1074 		       sysctl_proc_plimit, 0, NULL, 0,			\
1075 		       CTL_PROC, PROC_CURPROC, PROC_PID_LIMIT, n,	\
1076 		       PROC_PID_LIMIT_TYPE_SOFT, CTL_EOL);		\
1077 	sysctl_createv(&proc_sysctllog, 0, NULL, NULL,			\
1078 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE|CTLFLAG_ANYWRITE, \
1079 		       CTLTYPE_QUAD, "hard",				\
1080 		       SYSCTL_DESCR("Process hard " s " limit"),	\
1081 		       sysctl_proc_plimit, 0, NULL, 0,			\
1082 		       CTL_PROC, PROC_CURPROC, PROC_PID_LIMIT, n,	\
1083 		       PROC_PID_LIMIT_TYPE_HARD, CTL_EOL);		\
1084 	} while (0/*CONSTCOND*/)
1085 
1086 	create_proc_plimit("cputime",		PROC_PID_LIMIT_CPU);
1087 	create_proc_plimit("filesize",		PROC_PID_LIMIT_FSIZE);
1088 	create_proc_plimit("datasize",		PROC_PID_LIMIT_DATA);
1089 	create_proc_plimit("stacksize",		PROC_PID_LIMIT_STACK);
1090 	create_proc_plimit("coredumpsize",	PROC_PID_LIMIT_CORE);
1091 	create_proc_plimit("memoryuse",		PROC_PID_LIMIT_RSS);
1092 	create_proc_plimit("memorylocked",	PROC_PID_LIMIT_MEMLOCK);
1093 	create_proc_plimit("maxproc",		PROC_PID_LIMIT_NPROC);
1094 	create_proc_plimit("descriptors",	PROC_PID_LIMIT_NOFILE);
1095 	create_proc_plimit("sbsize",		PROC_PID_LIMIT_SBSIZE);
1096 	create_proc_plimit("vmemoryuse",	PROC_PID_LIMIT_AS);
1097 	create_proc_plimit("maxlwp",		PROC_PID_LIMIT_NTHR);
1098 
1099 #undef create_proc_plimit
1100 
1101 	sysctl_createv(&proc_sysctllog, 0, NULL, NULL,
1102 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE|CTLFLAG_ANYWRITE,
1103 		       CTLTYPE_INT, "stopfork",
1104 		       SYSCTL_DESCR("Stop process at fork(2)"),
1105 		       sysctl_proc_stop, 0, NULL, 0,
1106 		       CTL_PROC, PROC_CURPROC, PROC_PID_STOPFORK, CTL_EOL);
1107 	sysctl_createv(&proc_sysctllog, 0, NULL, NULL,
1108 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE|CTLFLAG_ANYWRITE,
1109 		       CTLTYPE_INT, "stopexec",
1110 		       SYSCTL_DESCR("Stop process at execve(2)"),
1111 		       sysctl_proc_stop, 0, NULL, 0,
1112 		       CTL_PROC, PROC_CURPROC, PROC_PID_STOPEXEC, CTL_EOL);
1113 	sysctl_createv(&proc_sysctllog, 0, NULL, NULL,
1114 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE|CTLFLAG_ANYWRITE,
1115 		       CTLTYPE_INT, "stopexit",
1116 		       SYSCTL_DESCR("Stop process before completing exit"),
1117 		       sysctl_proc_stop, 0, NULL, 0,
1118 		       CTL_PROC, PROC_CURPROC, PROC_PID_STOPEXIT, CTL_EOL);
1119 }
1120