xref: /netbsd-src/sys/kern/kern_resource.c (revision 5bbd2a12505d72a8177929a37b5cee489d0a1cfd)
1 /*	$NetBSD: kern_resource.c,v 1.169 2012/06/09 02:31:15 christos Exp $	*/
2 
3 /*-
4  * Copyright (c) 1982, 1986, 1991, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  * (c) UNIX System Laboratories, Inc.
7  * All or some portions of this file are derived from material licensed
8  * to the University of California by American Telephone and Telegraph
9  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
10  * the permission of UNIX System Laboratories, Inc.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  * 3. Neither the name of the University nor the names of its contributors
21  *    may be used to endorse or promote products derived from this software
22  *    without specific prior written permission.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34  * SUCH DAMAGE.
35  *
36  *	@(#)kern_resource.c	8.8 (Berkeley) 2/14/95
37  */
38 
39 #include <sys/cdefs.h>
40 __KERNEL_RCSID(0, "$NetBSD: kern_resource.c,v 1.169 2012/06/09 02:31:15 christos Exp $");
41 
42 #include <sys/param.h>
43 #include <sys/systm.h>
44 #include <sys/kernel.h>
45 #include <sys/file.h>
46 #include <sys/resourcevar.h>
47 #include <sys/kmem.h>
48 #include <sys/namei.h>
49 #include <sys/pool.h>
50 #include <sys/proc.h>
51 #include <sys/sysctl.h>
52 #include <sys/timevar.h>
53 #include <sys/kauth.h>
54 #include <sys/atomic.h>
55 #include <sys/mount.h>
56 #include <sys/syscallargs.h>
57 #include <sys/atomic.h>
58 
59 #include <uvm/uvm_extern.h>
60 
61 /*
62  * Maximum process data and stack limits.
63  * They are variables so they are patchable.
64  */
65 rlim_t			maxdmap = MAXDSIZ;
66 rlim_t			maxsmap = MAXSSIZ;
67 
68 static pool_cache_t	plimit_cache	__read_mostly;
69 static pool_cache_t	pstats_cache	__read_mostly;
70 
71 static kauth_listener_t	resource_listener;
72 static struct sysctllog	*proc_sysctllog;
73 
74 static int	donice(struct lwp *, struct proc *, int);
75 static void	sysctl_proc_setup(void);
76 
77 static int
78 resource_listener_cb(kauth_cred_t cred, kauth_action_t action, void *cookie,
79     void *arg0, void *arg1, void *arg2, void *arg3)
80 {
81 	struct proc *p;
82 	int result;
83 
84 	result = KAUTH_RESULT_DEFER;
85 	p = arg0;
86 
87 	switch (action) {
88 	case KAUTH_PROCESS_NICE:
89 		if (kauth_cred_geteuid(cred) != kauth_cred_geteuid(p->p_cred) &&
90 		    kauth_cred_getuid(cred) != kauth_cred_geteuid(p->p_cred)) {
91 			break;
92 		}
93 
94 		if ((u_long)arg1 >= p->p_nice)
95 			result = KAUTH_RESULT_ALLOW;
96 
97 		break;
98 
99 	case KAUTH_PROCESS_RLIMIT: {
100 		enum kauth_process_req req;
101 
102 		req = (enum kauth_process_req)(unsigned long)arg1;
103 
104 		switch (req) {
105 		case KAUTH_REQ_PROCESS_RLIMIT_GET:
106 			result = KAUTH_RESULT_ALLOW;
107 			break;
108 
109 		case KAUTH_REQ_PROCESS_RLIMIT_SET: {
110 			struct rlimit *new_rlimit;
111 			u_long which;
112 
113 			if ((p != curlwp->l_proc) &&
114 			    (proc_uidmatch(cred, p->p_cred) != 0))
115 				break;
116 
117 			new_rlimit = arg2;
118 			which = (u_long)arg3;
119 
120 			if (new_rlimit->rlim_max <= p->p_rlimit[which].rlim_max)
121 				result = KAUTH_RESULT_ALLOW;
122 
123 			break;
124 			}
125 
126 		default:
127 			break;
128 		}
129 
130 		break;
131 	}
132 
133 	default:
134 		break;
135 	}
136 
137 	return result;
138 }
139 
140 void
141 resource_init(void)
142 {
143 
144 	plimit_cache = pool_cache_init(sizeof(struct plimit), 0, 0, 0,
145 	    "plimitpl", NULL, IPL_NONE, NULL, NULL, NULL);
146 	pstats_cache = pool_cache_init(sizeof(struct pstats), 0, 0, 0,
147 	    "pstatspl", NULL, IPL_NONE, NULL, NULL, NULL);
148 
149 	resource_listener = kauth_listen_scope(KAUTH_SCOPE_PROCESS,
150 	    resource_listener_cb, NULL);
151 
152 	sysctl_proc_setup();
153 }
154 
155 /*
156  * Resource controls and accounting.
157  */
158 
159 int
160 sys_getpriority(struct lwp *l, const struct sys_getpriority_args *uap,
161     register_t *retval)
162 {
163 	/* {
164 		syscallarg(int) which;
165 		syscallarg(id_t) who;
166 	} */
167 	struct proc *curp = l->l_proc, *p;
168 	id_t who = SCARG(uap, who);
169 	int low = NZERO + PRIO_MAX + 1;
170 
171 	mutex_enter(proc_lock);
172 	switch (SCARG(uap, which)) {
173 	case PRIO_PROCESS:
174 		p = who ? proc_find(who) : curp;;
175 		if (p != NULL)
176 			low = p->p_nice;
177 		break;
178 
179 	case PRIO_PGRP: {
180 		struct pgrp *pg;
181 
182 		if (who == 0)
183 			pg = curp->p_pgrp;
184 		else if ((pg = pgrp_find(who)) == NULL)
185 			break;
186 		LIST_FOREACH(p, &pg->pg_members, p_pglist) {
187 			if (p->p_nice < low)
188 				low = p->p_nice;
189 		}
190 		break;
191 	}
192 
193 	case PRIO_USER:
194 		if (who == 0)
195 			who = (int)kauth_cred_geteuid(l->l_cred);
196 		PROCLIST_FOREACH(p, &allproc) {
197 			mutex_enter(p->p_lock);
198 			if (kauth_cred_geteuid(p->p_cred) ==
199 			    (uid_t)who && p->p_nice < low)
200 				low = p->p_nice;
201 			mutex_exit(p->p_lock);
202 		}
203 		break;
204 
205 	default:
206 		mutex_exit(proc_lock);
207 		return EINVAL;
208 	}
209 	mutex_exit(proc_lock);
210 
211 	if (low == NZERO + PRIO_MAX + 1) {
212 		return ESRCH;
213 	}
214 	*retval = low - NZERO;
215 	return 0;
216 }
217 
218 int
219 sys_setpriority(struct lwp *l, const struct sys_setpriority_args *uap,
220     register_t *retval)
221 {
222 	/* {
223 		syscallarg(int) which;
224 		syscallarg(id_t) who;
225 		syscallarg(int) prio;
226 	} */
227 	struct proc *curp = l->l_proc, *p;
228 	id_t who = SCARG(uap, who);
229 	int found = 0, error = 0;
230 
231 	mutex_enter(proc_lock);
232 	switch (SCARG(uap, which)) {
233 	case PRIO_PROCESS:
234 		p = who ? proc_find(who) : curp;
235 		if (p != NULL) {
236 			mutex_enter(p->p_lock);
237 			found++;
238 			error = donice(l, p, SCARG(uap, prio));
239 			mutex_exit(p->p_lock);
240 		}
241 		break;
242 
243 	case PRIO_PGRP: {
244 		struct pgrp *pg;
245 
246 		if (who == 0)
247 			pg = curp->p_pgrp;
248 		else if ((pg = pgrp_find(who)) == NULL)
249 			break;
250 		LIST_FOREACH(p, &pg->pg_members, p_pglist) {
251 			mutex_enter(p->p_lock);
252 			found++;
253 			error = donice(l, p, SCARG(uap, prio));
254 			mutex_exit(p->p_lock);
255 			if (error)
256 				break;
257 		}
258 		break;
259 	}
260 
261 	case PRIO_USER:
262 		if (who == 0)
263 			who = (int)kauth_cred_geteuid(l->l_cred);
264 		PROCLIST_FOREACH(p, &allproc) {
265 			mutex_enter(p->p_lock);
266 			if (kauth_cred_geteuid(p->p_cred) ==
267 			    (uid_t)SCARG(uap, who)) {
268 				found++;
269 				error = donice(l, p, SCARG(uap, prio));
270 			}
271 			mutex_exit(p->p_lock);
272 			if (error)
273 				break;
274 		}
275 		break;
276 
277 	default:
278 		mutex_exit(proc_lock);
279 		return EINVAL;
280 	}
281 	mutex_exit(proc_lock);
282 
283 	return (found == 0) ? ESRCH : error;
284 }
285 
286 /*
287  * Renice a process.
288  *
289  * Call with the target process' credentials locked.
290  */
291 static int
292 donice(struct lwp *l, struct proc *chgp, int n)
293 {
294 	kauth_cred_t cred = l->l_cred;
295 
296 	KASSERT(mutex_owned(chgp->p_lock));
297 
298 	if (kauth_cred_geteuid(cred) && kauth_cred_getuid(cred) &&
299 	    kauth_cred_geteuid(cred) != kauth_cred_geteuid(chgp->p_cred) &&
300 	    kauth_cred_getuid(cred) != kauth_cred_geteuid(chgp->p_cred))
301 		return EPERM;
302 
303 	if (n > PRIO_MAX) {
304 		n = PRIO_MAX;
305 	}
306 	if (n < PRIO_MIN) {
307 		n = PRIO_MIN;
308 	}
309 	n += NZERO;
310 
311 	if (kauth_authorize_process(cred, KAUTH_PROCESS_NICE, chgp,
312 	    KAUTH_ARG(n), NULL, NULL)) {
313 		return EACCES;
314 	}
315 
316 	sched_nice(chgp, n);
317 	return 0;
318 }
319 
320 int
321 sys_setrlimit(struct lwp *l, const struct sys_setrlimit_args *uap,
322     register_t *retval)
323 {
324 	/* {
325 		syscallarg(int) which;
326 		syscallarg(const struct rlimit *) rlp;
327 	} */
328 	int error, which = SCARG(uap, which);
329 	struct rlimit alim;
330 
331 	error = copyin(SCARG(uap, rlp), &alim, sizeof(struct rlimit));
332 	if (error) {
333 		return error;
334 	}
335 	return dosetrlimit(l, l->l_proc, which, &alim);
336 }
337 
338 int
339 dosetrlimit(struct lwp *l, struct proc *p, int which, struct rlimit *limp)
340 {
341 	struct rlimit *alimp;
342 	int error;
343 
344 	if ((u_int)which >= RLIM_NLIMITS)
345 		return EINVAL;
346 
347 	if (limp->rlim_cur > limp->rlim_max) {
348 		/*
349 		 * This is programming error. According to SUSv2, we should
350 		 * return error in this case.
351 		 */
352 		return EINVAL;
353 	}
354 
355 	alimp = &p->p_rlimit[which];
356 	/* if we don't change the value, no need to limcopy() */
357 	if (limp->rlim_cur == alimp->rlim_cur &&
358 	    limp->rlim_max == alimp->rlim_max)
359 		return 0;
360 
361 	error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_RLIMIT,
362 	    p, KAUTH_ARG(KAUTH_REQ_PROCESS_RLIMIT_SET), limp, KAUTH_ARG(which));
363 	if (error)
364 		return error;
365 
366 	lim_privatise(p);
367 	/* p->p_limit is now unchangeable */
368 	alimp = &p->p_rlimit[which];
369 
370 	switch (which) {
371 
372 	case RLIMIT_DATA:
373 		if (limp->rlim_cur > maxdmap)
374 			limp->rlim_cur = maxdmap;
375 		if (limp->rlim_max > maxdmap)
376 			limp->rlim_max = maxdmap;
377 		break;
378 
379 	case RLIMIT_STACK:
380 		if (limp->rlim_cur > maxsmap)
381 			limp->rlim_cur = maxsmap;
382 		if (limp->rlim_max > maxsmap)
383 			limp->rlim_max = maxsmap;
384 
385 		/*
386 		 * Return EINVAL if the new stack size limit is lower than
387 		 * current usage. Otherwise, the process would get SIGSEGV the
388 		 * moment it would try to access anything on it's current stack.
389 		 * This conforms to SUSv2.
390 		 */
391 		if (limp->rlim_cur < p->p_vmspace->vm_ssize * PAGE_SIZE ||
392 		    limp->rlim_max < p->p_vmspace->vm_ssize * PAGE_SIZE) {
393 			return EINVAL;
394 		}
395 
396 		/*
397 		 * Stack is allocated to the max at exec time with
398 		 * only "rlim_cur" bytes accessible (In other words,
399 		 * allocates stack dividing two contiguous regions at
400 		 * "rlim_cur" bytes boundary).
401 		 *
402 		 * Since allocation is done in terms of page, roundup
403 		 * "rlim_cur" (otherwise, contiguous regions
404 		 * overlap).  If stack limit is going up make more
405 		 * accessible, if going down make inaccessible.
406 		 */
407 		limp->rlim_cur = round_page(limp->rlim_cur);
408 		if (limp->rlim_cur != alimp->rlim_cur) {
409 			vaddr_t addr;
410 			vsize_t size;
411 			vm_prot_t prot;
412 
413 			if (limp->rlim_cur > alimp->rlim_cur) {
414 				prot = VM_PROT_READ | VM_PROT_WRITE;
415 				size = limp->rlim_cur - alimp->rlim_cur;
416 				addr = (vaddr_t)p->p_vmspace->vm_minsaddr -
417 				    limp->rlim_cur;
418 			} else {
419 				prot = VM_PROT_NONE;
420 				size = alimp->rlim_cur - limp->rlim_cur;
421 				addr = (vaddr_t)p->p_vmspace->vm_minsaddr -
422 				     alimp->rlim_cur;
423 			}
424 			(void) uvm_map_protect(&p->p_vmspace->vm_map,
425 			    addr, addr+size, prot, false);
426 		}
427 		break;
428 
429 	case RLIMIT_NOFILE:
430 		if (limp->rlim_cur > maxfiles)
431 			limp->rlim_cur = maxfiles;
432 		if (limp->rlim_max > maxfiles)
433 			limp->rlim_max = maxfiles;
434 		break;
435 
436 	case RLIMIT_NPROC:
437 		if (limp->rlim_cur > maxproc)
438 			limp->rlim_cur = maxproc;
439 		if (limp->rlim_max > maxproc)
440 			limp->rlim_max = maxproc;
441 		break;
442 
443 	case RLIMIT_NTHR:
444 		if (limp->rlim_cur > maxlwp)
445 			limp->rlim_cur = maxlwp;
446 		if (limp->rlim_max > maxlwp)
447 			limp->rlim_max = maxlwp;
448 		break;
449 	}
450 
451 	mutex_enter(&p->p_limit->pl_lock);
452 	*alimp = *limp;
453 	mutex_exit(&p->p_limit->pl_lock);
454 	return 0;
455 }
456 
457 int
458 sys_getrlimit(struct lwp *l, const struct sys_getrlimit_args *uap,
459     register_t *retval)
460 {
461 	/* {
462 		syscallarg(int) which;
463 		syscallarg(struct rlimit *) rlp;
464 	} */
465 	struct proc *p = l->l_proc;
466 	int which = SCARG(uap, which);
467 	struct rlimit rl;
468 
469 	if ((u_int)which >= RLIM_NLIMITS)
470 		return EINVAL;
471 
472 	mutex_enter(p->p_lock);
473 	memcpy(&rl, &p->p_rlimit[which], sizeof(rl));
474 	mutex_exit(p->p_lock);
475 
476 	return copyout(&rl, SCARG(uap, rlp), sizeof(rl));
477 }
478 
479 /*
480  * Transform the running time and tick information in proc p into user,
481  * system, and interrupt time usage.
482  *
483  * Should be called with p->p_lock held unless called from exit1().
484  */
485 void
486 calcru(struct proc *p, struct timeval *up, struct timeval *sp,
487     struct timeval *ip, struct timeval *rp)
488 {
489 	uint64_t u, st, ut, it, tot;
490 	struct lwp *l;
491 	struct bintime tm;
492 	struct timeval tv;
493 
494 	KASSERT(p->p_stat == SDEAD || mutex_owned(p->p_lock));
495 
496 	mutex_spin_enter(&p->p_stmutex);
497 	st = p->p_sticks;
498 	ut = p->p_uticks;
499 	it = p->p_iticks;
500 	mutex_spin_exit(&p->p_stmutex);
501 
502 	tm = p->p_rtime;
503 
504 	LIST_FOREACH(l, &p->p_lwps, l_sibling) {
505 		lwp_lock(l);
506 		bintime_add(&tm, &l->l_rtime);
507 		if ((l->l_pflag & LP_RUNNING) != 0) {
508 			struct bintime diff;
509 			/*
510 			 * Adjust for the current time slice.  This is
511 			 * actually fairly important since the error
512 			 * here is on the order of a time quantum,
513 			 * which is much greater than the sampling
514 			 * error.
515 			 */
516 			binuptime(&diff);
517 			bintime_sub(&diff, &l->l_stime);
518 			bintime_add(&tm, &diff);
519 		}
520 		lwp_unlock(l);
521 	}
522 
523 	tot = st + ut + it;
524 	bintime2timeval(&tm, &tv);
525 	u = (uint64_t)tv.tv_sec * 1000000ul + tv.tv_usec;
526 
527 	if (tot == 0) {
528 		/* No ticks, so can't use to share time out, split 50-50 */
529 		st = ut = u / 2;
530 	} else {
531 		st = (u * st) / tot;
532 		ut = (u * ut) / tot;
533 	}
534 	if (sp != NULL) {
535 		sp->tv_sec = st / 1000000;
536 		sp->tv_usec = st % 1000000;
537 	}
538 	if (up != NULL) {
539 		up->tv_sec = ut / 1000000;
540 		up->tv_usec = ut % 1000000;
541 	}
542 	if (ip != NULL) {
543 		if (it != 0)
544 			it = (u * it) / tot;
545 		ip->tv_sec = it / 1000000;
546 		ip->tv_usec = it % 1000000;
547 	}
548 	if (rp != NULL) {
549 		*rp = tv;
550 	}
551 }
552 
553 int
554 sys___getrusage50(struct lwp *l, const struct sys___getrusage50_args *uap,
555     register_t *retval)
556 {
557 	/* {
558 		syscallarg(int) who;
559 		syscallarg(struct rusage *) rusage;
560 	} */
561 	struct rusage ru;
562 	struct proc *p = l->l_proc;
563 
564 	switch (SCARG(uap, who)) {
565 	case RUSAGE_SELF:
566 		mutex_enter(p->p_lock);
567 		memcpy(&ru, &p->p_stats->p_ru, sizeof(ru));
568 		calcru(p, &ru.ru_utime, &ru.ru_stime, NULL, NULL);
569 		rulwps(p, &ru);
570 		mutex_exit(p->p_lock);
571 		break;
572 
573 	case RUSAGE_CHILDREN:
574 		mutex_enter(p->p_lock);
575 		memcpy(&ru, &p->p_stats->p_cru, sizeof(ru));
576 		mutex_exit(p->p_lock);
577 		break;
578 
579 	default:
580 		return EINVAL;
581 	}
582 
583 	return copyout(&ru, SCARG(uap, rusage), sizeof(ru));
584 }
585 
586 void
587 ruadd(struct rusage *ru, struct rusage *ru2)
588 {
589 	long *ip, *ip2;
590 	int i;
591 
592 	timeradd(&ru->ru_utime, &ru2->ru_utime, &ru->ru_utime);
593 	timeradd(&ru->ru_stime, &ru2->ru_stime, &ru->ru_stime);
594 	if (ru->ru_maxrss < ru2->ru_maxrss)
595 		ru->ru_maxrss = ru2->ru_maxrss;
596 	ip = &ru->ru_first; ip2 = &ru2->ru_first;
597 	for (i = &ru->ru_last - &ru->ru_first; i >= 0; i--)
598 		*ip++ += *ip2++;
599 }
600 
601 void
602 rulwps(proc_t *p, struct rusage *ru)
603 {
604 	lwp_t *l;
605 
606 	KASSERT(mutex_owned(p->p_lock));
607 
608 	LIST_FOREACH(l, &p->p_lwps, l_sibling) {
609 		ruadd(ru, &l->l_ru);
610 		ru->ru_nvcsw += (l->l_ncsw - l->l_nivcsw);
611 		ru->ru_nivcsw += l->l_nivcsw;
612 	}
613 }
614 
615 /*
616  * lim_copy: make a copy of the plimit structure.
617  *
618  * We use copy-on-write after fork, and copy when a limit is changed.
619  */
620 struct plimit *
621 lim_copy(struct plimit *lim)
622 {
623 	struct plimit *newlim;
624 	char *corename;
625 	size_t alen, len;
626 
627 	newlim = pool_cache_get(plimit_cache, PR_WAITOK);
628 	mutex_init(&newlim->pl_lock, MUTEX_DEFAULT, IPL_NONE);
629 	newlim->pl_writeable = false;
630 	newlim->pl_refcnt = 1;
631 	newlim->pl_sv_limit = NULL;
632 
633 	mutex_enter(&lim->pl_lock);
634 	memcpy(newlim->pl_rlimit, lim->pl_rlimit,
635 	    sizeof(struct rlimit) * RLIM_NLIMITS);
636 
637 	/*
638 	 * Note: the common case is a use of default core name.
639 	 */
640 	alen = 0;
641 	corename = NULL;
642 	for (;;) {
643 		if (lim->pl_corename == defcorename) {
644 			newlim->pl_corename = defcorename;
645 			newlim->pl_cnlen = 0;
646 			break;
647 		}
648 		len = lim->pl_cnlen;
649 		if (len == alen) {
650 			newlim->pl_corename = corename;
651 			newlim->pl_cnlen = len;
652 			memcpy(corename, lim->pl_corename, len);
653 			corename = NULL;
654 			break;
655 		}
656 		mutex_exit(&lim->pl_lock);
657 		if (corename) {
658 			kmem_free(corename, alen);
659 		}
660 		alen = len;
661 		corename = kmem_alloc(alen, KM_SLEEP);
662 		mutex_enter(&lim->pl_lock);
663 	}
664 	mutex_exit(&lim->pl_lock);
665 
666 	if (corename) {
667 		kmem_free(corename, alen);
668 	}
669 	return newlim;
670 }
671 
672 void
673 lim_addref(struct plimit *lim)
674 {
675 	atomic_inc_uint(&lim->pl_refcnt);
676 }
677 
678 /*
679  * lim_privatise: give a process its own private plimit structure.
680  */
681 void
682 lim_privatise(proc_t *p)
683 {
684 	struct plimit *lim = p->p_limit, *newlim;
685 
686 	if (lim->pl_writeable) {
687 		return;
688 	}
689 
690 	newlim = lim_copy(lim);
691 
692 	mutex_enter(p->p_lock);
693 	if (p->p_limit->pl_writeable) {
694 		/* Other thread won the race. */
695 		mutex_exit(p->p_lock);
696 		lim_free(newlim);
697 		return;
698 	}
699 
700 	/*
701 	 * Since p->p_limit can be accessed without locked held,
702 	 * old limit structure must not be deleted yet.
703 	 */
704 	newlim->pl_sv_limit = p->p_limit;
705 	newlim->pl_writeable = true;
706 	p->p_limit = newlim;
707 	mutex_exit(p->p_lock);
708 }
709 
710 void
711 lim_setcorename(proc_t *p, char *name, size_t len)
712 {
713 	struct plimit *lim;
714 	char *oname;
715 	size_t olen;
716 
717 	lim_privatise(p);
718 	lim = p->p_limit;
719 
720 	mutex_enter(&lim->pl_lock);
721 	oname = lim->pl_corename;
722 	olen = lim->pl_cnlen;
723 	lim->pl_corename = name;
724 	lim->pl_cnlen = len;
725 	mutex_exit(&lim->pl_lock);
726 
727 	if (oname != defcorename) {
728 		kmem_free(oname, olen);
729 	}
730 }
731 
732 void
733 lim_free(struct plimit *lim)
734 {
735 	struct plimit *sv_lim;
736 
737 	do {
738 		if (atomic_dec_uint_nv(&lim->pl_refcnt) > 0) {
739 			return;
740 		}
741 		if (lim->pl_corename != defcorename) {
742 			kmem_free(lim->pl_corename, lim->pl_cnlen);
743 		}
744 		sv_lim = lim->pl_sv_limit;
745 		mutex_destroy(&lim->pl_lock);
746 		pool_cache_put(plimit_cache, lim);
747 	} while ((lim = sv_lim) != NULL);
748 }
749 
750 struct pstats *
751 pstatscopy(struct pstats *ps)
752 {
753 	struct pstats *nps;
754 	size_t len;
755 
756 	nps = pool_cache_get(pstats_cache, PR_WAITOK);
757 
758 	len = (char *)&nps->pstat_endzero - (char *)&nps->pstat_startzero;
759 	memset(&nps->pstat_startzero, 0, len);
760 
761 	len = (char *)&nps->pstat_endcopy - (char *)&nps->pstat_startcopy;
762 	memcpy(&nps->pstat_startcopy, &ps->pstat_startcopy, len);
763 
764 	return nps;
765 }
766 
767 void
768 pstatsfree(struct pstats *ps)
769 {
770 
771 	pool_cache_put(pstats_cache, ps);
772 }
773 
774 /*
775  * sysctl_proc_findproc: a routine for sysctl proc subtree helpers that
776  * need to pick a valid process by PID.
777  *
778  * => Hold a reference on the process, on success.
779  */
780 static int
781 sysctl_proc_findproc(lwp_t *l, pid_t pid, proc_t **p2)
782 {
783 	proc_t *p;
784 	int error;
785 
786 	if (pid == PROC_CURPROC) {
787 		p = l->l_proc;
788 	} else {
789 		mutex_enter(proc_lock);
790 		p = proc_find(pid);
791 		if (p == NULL) {
792 			mutex_exit(proc_lock);
793 			return ESRCH;
794 		}
795 	}
796 	error = rw_tryenter(&p->p_reflock, RW_READER) ? 0 : EBUSY;
797 	if (pid != PROC_CURPROC) {
798 		mutex_exit(proc_lock);
799 	}
800 	*p2 = p;
801 	return error;
802 }
803 
804 /*
805  * sysctl_proc_corename: helper routine to get or set the core file name
806  * for a process specified by PID.
807  */
808 static int
809 sysctl_proc_corename(SYSCTLFN_ARGS)
810 {
811 	struct proc *p;
812 	struct plimit *lim;
813 	char *cnbuf, *cname;
814 	struct sysctlnode node;
815 	size_t len;
816 	int error;
817 
818 	/* First, validate the request. */
819 	if (namelen != 0 || name[-1] != PROC_PID_CORENAME)
820 		return EINVAL;
821 
822 	/* Find the process.  Hold a reference (p_reflock), if found. */
823 	error = sysctl_proc_findproc(l, (pid_t)name[-2], &p);
824 	if (error)
825 		return error;
826 
827 	/* XXX-elad */
828 	error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_CANSEE, p,
829 	    KAUTH_ARG(KAUTH_REQ_PROCESS_CANSEE_ENTRY), NULL, NULL);
830 	if (error) {
831 		rw_exit(&p->p_reflock);
832 		return error;
833 	}
834 
835 	cnbuf = PNBUF_GET();
836 
837 	if (oldp) {
838 		/* Get case: copy the core name into the buffer. */
839 		error = kauth_authorize_process(l->l_cred,
840 		    KAUTH_PROCESS_CORENAME, p,
841 		    KAUTH_ARG(KAUTH_REQ_PROCESS_CORENAME_GET), NULL, NULL);
842 		if (error) {
843 			goto done;
844 		}
845 		lim = p->p_limit;
846 		mutex_enter(&lim->pl_lock);
847 		strlcpy(cnbuf, lim->pl_corename, MAXPATHLEN);
848 		mutex_exit(&lim->pl_lock);
849 	}
850 
851 	node = *rnode;
852 	node.sysctl_data = cnbuf;
853 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
854 
855 	/* Return if error, or if caller is only getting the core name. */
856 	if (error || newp == NULL) {
857 		goto done;
858 	}
859 
860 	/*
861 	 * Set case.  Check permission and then validate new core name.
862 	 * It must be either "core", "/core", or end in ".core".
863 	 */
864 	error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_CORENAME,
865 	    p, KAUTH_ARG(KAUTH_REQ_PROCESS_CORENAME_SET), cnbuf, NULL);
866 	if (error) {
867 		goto done;
868 	}
869 	len = strlen(cnbuf);
870 	if ((len < 4 || strcmp(cnbuf + len - 4, "core") != 0) ||
871 	    (len > 4 && cnbuf[len - 5] != '/' && cnbuf[len - 5] != '.')) {
872 		error = EINVAL;
873 		goto done;
874 	}
875 
876 	/* Allocate, copy and set the new core name for plimit structure. */
877 	cname = kmem_alloc(++len, KM_NOSLEEP);
878 	if (cname == NULL) {
879 		error = ENOMEM;
880 		goto done;
881 	}
882 	memcpy(cname, cnbuf, len);
883 	lim_setcorename(p, cname, len);
884 done:
885 	rw_exit(&p->p_reflock);
886 	PNBUF_PUT(cnbuf);
887 	return error;
888 }
889 
890 /*
891  * sysctl_proc_stop: helper routine for checking/setting the stop flags.
892  */
893 static int
894 sysctl_proc_stop(SYSCTLFN_ARGS)
895 {
896 	struct proc *p;
897 	int isset, flag, error = 0;
898 	struct sysctlnode node;
899 
900 	if (namelen != 0)
901 		return EINVAL;
902 
903 	/* Find the process.  Hold a reference (p_reflock), if found. */
904 	error = sysctl_proc_findproc(l, (pid_t)name[-2], &p);
905 	if (error)
906 		return error;
907 
908 	/* XXX-elad */
909 	error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_CANSEE, p,
910 	    KAUTH_ARG(KAUTH_REQ_PROCESS_CANSEE_ENTRY), NULL, NULL);
911 	if (error) {
912 		goto out;
913 	}
914 
915 	/* Determine the flag. */
916 	switch (rnode->sysctl_num) {
917 	case PROC_PID_STOPFORK:
918 		flag = PS_STOPFORK;
919 		break;
920 	case PROC_PID_STOPEXEC:
921 		flag = PS_STOPEXEC;
922 		break;
923 	case PROC_PID_STOPEXIT:
924 		flag = PS_STOPEXIT;
925 		break;
926 	default:
927 		error = EINVAL;
928 		goto out;
929 	}
930 	isset = (p->p_flag & flag) ? 1 : 0;
931 	node = *rnode;
932 	node.sysctl_data = &isset;
933 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
934 
935 	/* Return if error, or if callers is only getting the flag. */
936 	if (error || newp == NULL) {
937 		goto out;
938 	}
939 
940 	/* Check if caller can set the flags. */
941 	error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_STOPFLAG,
942 	    p, KAUTH_ARG(flag), NULL, NULL);
943 	if (error) {
944 		goto out;
945 	}
946 	mutex_enter(p->p_lock);
947 	if (isset) {
948 		p->p_sflag |= flag;
949 	} else {
950 		p->p_sflag &= ~flag;
951 	}
952 	mutex_exit(p->p_lock);
953 out:
954 	rw_exit(&p->p_reflock);
955 	return error;
956 }
957 
958 /*
959  * sysctl_proc_plimit: helper routine to get/set rlimits of a process.
960  */
961 static int
962 sysctl_proc_plimit(SYSCTLFN_ARGS)
963 {
964 	struct proc *p;
965 	u_int limitno;
966 	int which, error = 0;
967         struct rlimit alim;
968 	struct sysctlnode node;
969 
970 	if (namelen != 0)
971 		return EINVAL;
972 
973 	which = name[-1];
974 	if (which != PROC_PID_LIMIT_TYPE_SOFT &&
975 	    which != PROC_PID_LIMIT_TYPE_HARD)
976 		return EINVAL;
977 
978 	limitno = name[-2] - 1;
979 	if (limitno >= RLIM_NLIMITS)
980 		return EINVAL;
981 
982 	if (name[-3] != PROC_PID_LIMIT)
983 		return EINVAL;
984 
985 	/* Find the process.  Hold a reference (p_reflock), if found. */
986 	error = sysctl_proc_findproc(l, (pid_t)name[-4], &p);
987 	if (error)
988 		return error;
989 
990 	/* XXX-elad */
991 	error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_CANSEE, p,
992 	    KAUTH_ARG(KAUTH_REQ_PROCESS_CANSEE_ENTRY), NULL, NULL);
993 	if (error)
994 		goto out;
995 
996 	/* Check if caller can retrieve the limits. */
997 	if (newp == NULL) {
998 		error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_RLIMIT,
999 		    p, KAUTH_ARG(KAUTH_REQ_PROCESS_RLIMIT_GET), &alim,
1000 		    KAUTH_ARG(which));
1001 		if (error)
1002 			goto out;
1003 	}
1004 
1005 	/* Retrieve the limits. */
1006 	node = *rnode;
1007 	memcpy(&alim, &p->p_rlimit[limitno], sizeof(alim));
1008 	if (which == PROC_PID_LIMIT_TYPE_HARD) {
1009 		node.sysctl_data = &alim.rlim_max;
1010 	} else {
1011 		node.sysctl_data = &alim.rlim_cur;
1012 	}
1013 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
1014 
1015 	/* Return if error, or if we are only retrieving the limits. */
1016 	if (error || newp == NULL) {
1017 		goto out;
1018 	}
1019 	error = dosetrlimit(l, p, limitno, &alim);
1020 out:
1021 	rw_exit(&p->p_reflock);
1022 	return error;
1023 }
1024 
1025 /*
1026  * Setup sysctl nodes.
1027  */
1028 static void
1029 sysctl_proc_setup(void)
1030 {
1031 
1032 	sysctl_createv(&proc_sysctllog, 0, NULL, NULL,
1033 		       CTLFLAG_PERMANENT,
1034 		       CTLTYPE_NODE, "proc", NULL,
1035 		       NULL, 0, NULL, 0,
1036 		       CTL_PROC, CTL_EOL);
1037 	sysctl_createv(&proc_sysctllog, 0, NULL, NULL,
1038 		       CTLFLAG_PERMANENT|CTLFLAG_ANYNUMBER,
1039 		       CTLTYPE_NODE, "curproc",
1040 		       SYSCTL_DESCR("Per-process settings"),
1041 		       NULL, 0, NULL, 0,
1042 		       CTL_PROC, PROC_CURPROC, CTL_EOL);
1043 
1044 	sysctl_createv(&proc_sysctllog, 0, NULL, NULL,
1045 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE|CTLFLAG_ANYWRITE,
1046 		       CTLTYPE_STRING, "corename",
1047 		       SYSCTL_DESCR("Core file name"),
1048 		       sysctl_proc_corename, 0, NULL, MAXPATHLEN,
1049 		       CTL_PROC, PROC_CURPROC, PROC_PID_CORENAME, CTL_EOL);
1050 	sysctl_createv(&proc_sysctllog, 0, NULL, NULL,
1051 		       CTLFLAG_PERMANENT,
1052 		       CTLTYPE_NODE, "rlimit",
1053 		       SYSCTL_DESCR("Process limits"),
1054 		       NULL, 0, NULL, 0,
1055 		       CTL_PROC, PROC_CURPROC, PROC_PID_LIMIT, CTL_EOL);
1056 
1057 #define create_proc_plimit(s, n) do {					\
1058 	sysctl_createv(&proc_sysctllog, 0, NULL, NULL,			\
1059 		       CTLFLAG_PERMANENT,				\
1060 		       CTLTYPE_NODE, s,					\
1061 		       SYSCTL_DESCR("Process " s " limits"),		\
1062 		       NULL, 0, NULL, 0,				\
1063 		       CTL_PROC, PROC_CURPROC, PROC_PID_LIMIT, n,	\
1064 		       CTL_EOL);					\
1065 	sysctl_createv(&proc_sysctllog, 0, NULL, NULL,			\
1066 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE|CTLFLAG_ANYWRITE, \
1067 		       CTLTYPE_QUAD, "soft",				\
1068 		       SYSCTL_DESCR("Process soft " s " limit"),	\
1069 		       sysctl_proc_plimit, 0, NULL, 0,			\
1070 		       CTL_PROC, PROC_CURPROC, PROC_PID_LIMIT, n,	\
1071 		       PROC_PID_LIMIT_TYPE_SOFT, CTL_EOL);		\
1072 	sysctl_createv(&proc_sysctllog, 0, NULL, NULL,			\
1073 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE|CTLFLAG_ANYWRITE, \
1074 		       CTLTYPE_QUAD, "hard",				\
1075 		       SYSCTL_DESCR("Process hard " s " limit"),	\
1076 		       sysctl_proc_plimit, 0, NULL, 0,			\
1077 		       CTL_PROC, PROC_CURPROC, PROC_PID_LIMIT, n,	\
1078 		       PROC_PID_LIMIT_TYPE_HARD, CTL_EOL);		\
1079 	} while (0/*CONSTCOND*/)
1080 
1081 	create_proc_plimit("cputime",		PROC_PID_LIMIT_CPU);
1082 	create_proc_plimit("filesize",		PROC_PID_LIMIT_FSIZE);
1083 	create_proc_plimit("datasize",		PROC_PID_LIMIT_DATA);
1084 	create_proc_plimit("stacksize",		PROC_PID_LIMIT_STACK);
1085 	create_proc_plimit("coredumpsize",	PROC_PID_LIMIT_CORE);
1086 	create_proc_plimit("memoryuse",		PROC_PID_LIMIT_RSS);
1087 	create_proc_plimit("memorylocked",	PROC_PID_LIMIT_MEMLOCK);
1088 	create_proc_plimit("maxproc",		PROC_PID_LIMIT_NPROC);
1089 	create_proc_plimit("descriptors",	PROC_PID_LIMIT_NOFILE);
1090 	create_proc_plimit("sbsize",		PROC_PID_LIMIT_SBSIZE);
1091 	create_proc_plimit("vmemoryuse",	PROC_PID_LIMIT_AS);
1092 	create_proc_plimit("maxlwp",		PROC_PID_LIMIT_NTHR);
1093 
1094 #undef create_proc_plimit
1095 
1096 	sysctl_createv(&proc_sysctllog, 0, NULL, NULL,
1097 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE|CTLFLAG_ANYWRITE,
1098 		       CTLTYPE_INT, "stopfork",
1099 		       SYSCTL_DESCR("Stop process at fork(2)"),
1100 		       sysctl_proc_stop, 0, NULL, 0,
1101 		       CTL_PROC, PROC_CURPROC, PROC_PID_STOPFORK, CTL_EOL);
1102 	sysctl_createv(&proc_sysctllog, 0, NULL, NULL,
1103 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE|CTLFLAG_ANYWRITE,
1104 		       CTLTYPE_INT, "stopexec",
1105 		       SYSCTL_DESCR("Stop process at execve(2)"),
1106 		       sysctl_proc_stop, 0, NULL, 0,
1107 		       CTL_PROC, PROC_CURPROC, PROC_PID_STOPEXEC, CTL_EOL);
1108 	sysctl_createv(&proc_sysctllog, 0, NULL, NULL,
1109 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE|CTLFLAG_ANYWRITE,
1110 		       CTLTYPE_INT, "stopexit",
1111 		       SYSCTL_DESCR("Stop process before completing exit"),
1112 		       sysctl_proc_stop, 0, NULL, 0,
1113 		       CTL_PROC, PROC_CURPROC, PROC_PID_STOPEXIT, CTL_EOL);
1114 }
1115