xref: /netbsd-src/sys/kern/kern_resource.c (revision e39ef1d61eee3ccba837ee281f1e098c864487aa)
1 /*	$NetBSD: kern_resource.c,v 1.168 2011/12/02 12:33:12 yamt Exp $	*/
2 
3 /*-
4  * Copyright (c) 1982, 1986, 1991, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  * (c) UNIX System Laboratories, Inc.
7  * All or some portions of this file are derived from material licensed
8  * to the University of California by American Telephone and Telegraph
9  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
10  * the permission of UNIX System Laboratories, Inc.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  * 3. Neither the name of the University nor the names of its contributors
21  *    may be used to endorse or promote products derived from this software
22  *    without specific prior written permission.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34  * SUCH DAMAGE.
35  *
36  *	@(#)kern_resource.c	8.8 (Berkeley) 2/14/95
37  */
38 
39 #include <sys/cdefs.h>
40 __KERNEL_RCSID(0, "$NetBSD: kern_resource.c,v 1.168 2011/12/02 12:33:12 yamt Exp $");
41 
42 #include <sys/param.h>
43 #include <sys/systm.h>
44 #include <sys/kernel.h>
45 #include <sys/file.h>
46 #include <sys/resourcevar.h>
47 #include <sys/kmem.h>
48 #include <sys/namei.h>
49 #include <sys/pool.h>
50 #include <sys/proc.h>
51 #include <sys/sysctl.h>
52 #include <sys/timevar.h>
53 #include <sys/kauth.h>
54 #include <sys/atomic.h>
55 #include <sys/mount.h>
56 #include <sys/syscallargs.h>
57 #include <sys/atomic.h>
58 
59 #include <uvm/uvm_extern.h>
60 
61 /*
62  * Maximum process data and stack limits.
63  * They are variables so they are patchable.
64  */
65 rlim_t			maxdmap = MAXDSIZ;
66 rlim_t			maxsmap = MAXSSIZ;
67 
68 static pool_cache_t	plimit_cache	__read_mostly;
69 static pool_cache_t	pstats_cache	__read_mostly;
70 
71 static kauth_listener_t	resource_listener;
72 static struct sysctllog	*proc_sysctllog;
73 
74 static int	donice(struct lwp *, struct proc *, int);
75 static void	sysctl_proc_setup(void);
76 
77 static int
78 resource_listener_cb(kauth_cred_t cred, kauth_action_t action, void *cookie,
79     void *arg0, void *arg1, void *arg2, void *arg3)
80 {
81 	struct proc *p;
82 	int result;
83 
84 	result = KAUTH_RESULT_DEFER;
85 	p = arg0;
86 
87 	switch (action) {
88 	case KAUTH_PROCESS_NICE:
89 		if (kauth_cred_geteuid(cred) != kauth_cred_geteuid(p->p_cred) &&
90 		    kauth_cred_getuid(cred) != kauth_cred_geteuid(p->p_cred)) {
91 			break;
92 		}
93 
94 		if ((u_long)arg1 >= p->p_nice)
95 			result = KAUTH_RESULT_ALLOW;
96 
97 		break;
98 
99 	case KAUTH_PROCESS_RLIMIT: {
100 		enum kauth_process_req req;
101 
102 		req = (enum kauth_process_req)(unsigned long)arg1;
103 
104 		switch (req) {
105 		case KAUTH_REQ_PROCESS_RLIMIT_GET:
106 			result = KAUTH_RESULT_ALLOW;
107 			break;
108 
109 		case KAUTH_REQ_PROCESS_RLIMIT_SET: {
110 			struct rlimit *new_rlimit;
111 			u_long which;
112 
113 			if ((p != curlwp->l_proc) &&
114 			    (proc_uidmatch(cred, p->p_cred) != 0))
115 				break;
116 
117 			new_rlimit = arg2;
118 			which = (u_long)arg3;
119 
120 			if (new_rlimit->rlim_max <= p->p_rlimit[which].rlim_max)
121 				result = KAUTH_RESULT_ALLOW;
122 
123 			break;
124 			}
125 
126 		default:
127 			break;
128 		}
129 
130 		break;
131 	}
132 
133 	default:
134 		break;
135 	}
136 
137 	return result;
138 }
139 
140 void
141 resource_init(void)
142 {
143 
144 	plimit_cache = pool_cache_init(sizeof(struct plimit), 0, 0, 0,
145 	    "plimitpl", NULL, IPL_NONE, NULL, NULL, NULL);
146 	pstats_cache = pool_cache_init(sizeof(struct pstats), 0, 0, 0,
147 	    "pstatspl", NULL, IPL_NONE, NULL, NULL, NULL);
148 
149 	resource_listener = kauth_listen_scope(KAUTH_SCOPE_PROCESS,
150 	    resource_listener_cb, NULL);
151 
152 	sysctl_proc_setup();
153 }
154 
155 /*
156  * Resource controls and accounting.
157  */
158 
159 int
160 sys_getpriority(struct lwp *l, const struct sys_getpriority_args *uap,
161     register_t *retval)
162 {
163 	/* {
164 		syscallarg(int) which;
165 		syscallarg(id_t) who;
166 	} */
167 	struct proc *curp = l->l_proc, *p;
168 	id_t who = SCARG(uap, who);
169 	int low = NZERO + PRIO_MAX + 1;
170 
171 	mutex_enter(proc_lock);
172 	switch (SCARG(uap, which)) {
173 	case PRIO_PROCESS:
174 		p = who ? proc_find(who) : curp;;
175 		if (p != NULL)
176 			low = p->p_nice;
177 		break;
178 
179 	case PRIO_PGRP: {
180 		struct pgrp *pg;
181 
182 		if (who == 0)
183 			pg = curp->p_pgrp;
184 		else if ((pg = pgrp_find(who)) == NULL)
185 			break;
186 		LIST_FOREACH(p, &pg->pg_members, p_pglist) {
187 			if (p->p_nice < low)
188 				low = p->p_nice;
189 		}
190 		break;
191 	}
192 
193 	case PRIO_USER:
194 		if (who == 0)
195 			who = (int)kauth_cred_geteuid(l->l_cred);
196 		PROCLIST_FOREACH(p, &allproc) {
197 			mutex_enter(p->p_lock);
198 			if (kauth_cred_geteuid(p->p_cred) ==
199 			    (uid_t)who && p->p_nice < low)
200 				low = p->p_nice;
201 			mutex_exit(p->p_lock);
202 		}
203 		break;
204 
205 	default:
206 		mutex_exit(proc_lock);
207 		return EINVAL;
208 	}
209 	mutex_exit(proc_lock);
210 
211 	if (low == NZERO + PRIO_MAX + 1) {
212 		return ESRCH;
213 	}
214 	*retval = low - NZERO;
215 	return 0;
216 }
217 
218 int
219 sys_setpriority(struct lwp *l, const struct sys_setpriority_args *uap,
220     register_t *retval)
221 {
222 	/* {
223 		syscallarg(int) which;
224 		syscallarg(id_t) who;
225 		syscallarg(int) prio;
226 	} */
227 	struct proc *curp = l->l_proc, *p;
228 	id_t who = SCARG(uap, who);
229 	int found = 0, error = 0;
230 
231 	mutex_enter(proc_lock);
232 	switch (SCARG(uap, which)) {
233 	case PRIO_PROCESS:
234 		p = who ? proc_find(who) : curp;
235 		if (p != NULL) {
236 			mutex_enter(p->p_lock);
237 			found++;
238 			error = donice(l, p, SCARG(uap, prio));
239 			mutex_exit(p->p_lock);
240 		}
241 		break;
242 
243 	case PRIO_PGRP: {
244 		struct pgrp *pg;
245 
246 		if (who == 0)
247 			pg = curp->p_pgrp;
248 		else if ((pg = pgrp_find(who)) == NULL)
249 			break;
250 		LIST_FOREACH(p, &pg->pg_members, p_pglist) {
251 			mutex_enter(p->p_lock);
252 			found++;
253 			error = donice(l, p, SCARG(uap, prio));
254 			mutex_exit(p->p_lock);
255 			if (error)
256 				break;
257 		}
258 		break;
259 	}
260 
261 	case PRIO_USER:
262 		if (who == 0)
263 			who = (int)kauth_cred_geteuid(l->l_cred);
264 		PROCLIST_FOREACH(p, &allproc) {
265 			mutex_enter(p->p_lock);
266 			if (kauth_cred_geteuid(p->p_cred) ==
267 			    (uid_t)SCARG(uap, who)) {
268 				found++;
269 				error = donice(l, p, SCARG(uap, prio));
270 			}
271 			mutex_exit(p->p_lock);
272 			if (error)
273 				break;
274 		}
275 		break;
276 
277 	default:
278 		mutex_exit(proc_lock);
279 		return EINVAL;
280 	}
281 	mutex_exit(proc_lock);
282 
283 	return (found == 0) ? ESRCH : error;
284 }
285 
286 /*
287  * Renice a process.
288  *
289  * Call with the target process' credentials locked.
290  */
291 static int
292 donice(struct lwp *l, struct proc *chgp, int n)
293 {
294 	kauth_cred_t cred = l->l_cred;
295 
296 	KASSERT(mutex_owned(chgp->p_lock));
297 
298 	if (kauth_cred_geteuid(cred) && kauth_cred_getuid(cred) &&
299 	    kauth_cred_geteuid(cred) != kauth_cred_geteuid(chgp->p_cred) &&
300 	    kauth_cred_getuid(cred) != kauth_cred_geteuid(chgp->p_cred))
301 		return EPERM;
302 
303 	if (n > PRIO_MAX) {
304 		n = PRIO_MAX;
305 	}
306 	if (n < PRIO_MIN) {
307 		n = PRIO_MIN;
308 	}
309 	n += NZERO;
310 
311 	if (kauth_authorize_process(cred, KAUTH_PROCESS_NICE, chgp,
312 	    KAUTH_ARG(n), NULL, NULL)) {
313 		return EACCES;
314 	}
315 
316 	sched_nice(chgp, n);
317 	return 0;
318 }
319 
320 int
321 sys_setrlimit(struct lwp *l, const struct sys_setrlimit_args *uap,
322     register_t *retval)
323 {
324 	/* {
325 		syscallarg(int) which;
326 		syscallarg(const struct rlimit *) rlp;
327 	} */
328 	int error, which = SCARG(uap, which);
329 	struct rlimit alim;
330 
331 	error = copyin(SCARG(uap, rlp), &alim, sizeof(struct rlimit));
332 	if (error) {
333 		return error;
334 	}
335 	return dosetrlimit(l, l->l_proc, which, &alim);
336 }
337 
338 int
339 dosetrlimit(struct lwp *l, struct proc *p, int which, struct rlimit *limp)
340 {
341 	struct rlimit *alimp;
342 	int error;
343 
344 	if ((u_int)which >= RLIM_NLIMITS)
345 		return EINVAL;
346 
347 	if (limp->rlim_cur > limp->rlim_max) {
348 		/*
349 		 * This is programming error. According to SUSv2, we should
350 		 * return error in this case.
351 		 */
352 		return EINVAL;
353 	}
354 
355 	alimp = &p->p_rlimit[which];
356 	/* if we don't change the value, no need to limcopy() */
357 	if (limp->rlim_cur == alimp->rlim_cur &&
358 	    limp->rlim_max == alimp->rlim_max)
359 		return 0;
360 
361 	error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_RLIMIT,
362 	    p, KAUTH_ARG(KAUTH_REQ_PROCESS_RLIMIT_SET), limp, KAUTH_ARG(which));
363 	if (error)
364 		return error;
365 
366 	lim_privatise(p);
367 	/* p->p_limit is now unchangeable */
368 	alimp = &p->p_rlimit[which];
369 
370 	switch (which) {
371 
372 	case RLIMIT_DATA:
373 		if (limp->rlim_cur > maxdmap)
374 			limp->rlim_cur = maxdmap;
375 		if (limp->rlim_max > maxdmap)
376 			limp->rlim_max = maxdmap;
377 		break;
378 
379 	case RLIMIT_STACK:
380 		if (limp->rlim_cur > maxsmap)
381 			limp->rlim_cur = maxsmap;
382 		if (limp->rlim_max > maxsmap)
383 			limp->rlim_max = maxsmap;
384 
385 		/*
386 		 * Return EINVAL if the new stack size limit is lower than
387 		 * current usage. Otherwise, the process would get SIGSEGV the
388 		 * moment it would try to access anything on it's current stack.
389 		 * This conforms to SUSv2.
390 		 */
391 		if (limp->rlim_cur < p->p_vmspace->vm_ssize * PAGE_SIZE ||
392 		    limp->rlim_max < p->p_vmspace->vm_ssize * PAGE_SIZE) {
393 			return EINVAL;
394 		}
395 
396 		/*
397 		 * Stack is allocated to the max at exec time with
398 		 * only "rlim_cur" bytes accessible (In other words,
399 		 * allocates stack dividing two contiguous regions at
400 		 * "rlim_cur" bytes boundary).
401 		 *
402 		 * Since allocation is done in terms of page, roundup
403 		 * "rlim_cur" (otherwise, contiguous regions
404 		 * overlap).  If stack limit is going up make more
405 		 * accessible, if going down make inaccessible.
406 		 */
407 		limp->rlim_cur = round_page(limp->rlim_cur);
408 		if (limp->rlim_cur != alimp->rlim_cur) {
409 			vaddr_t addr;
410 			vsize_t size;
411 			vm_prot_t prot;
412 
413 			if (limp->rlim_cur > alimp->rlim_cur) {
414 				prot = VM_PROT_READ | VM_PROT_WRITE;
415 				size = limp->rlim_cur - alimp->rlim_cur;
416 				addr = (vaddr_t)p->p_vmspace->vm_minsaddr -
417 				    limp->rlim_cur;
418 			} else {
419 				prot = VM_PROT_NONE;
420 				size = alimp->rlim_cur - limp->rlim_cur;
421 				addr = (vaddr_t)p->p_vmspace->vm_minsaddr -
422 				     alimp->rlim_cur;
423 			}
424 			(void) uvm_map_protect(&p->p_vmspace->vm_map,
425 			    addr, addr+size, prot, false);
426 		}
427 		break;
428 
429 	case RLIMIT_NOFILE:
430 		if (limp->rlim_cur > maxfiles)
431 			limp->rlim_cur = maxfiles;
432 		if (limp->rlim_max > maxfiles)
433 			limp->rlim_max = maxfiles;
434 		break;
435 
436 	case RLIMIT_NPROC:
437 		if (limp->rlim_cur > maxproc)
438 			limp->rlim_cur = maxproc;
439 		if (limp->rlim_max > maxproc)
440 			limp->rlim_max = maxproc;
441 		break;
442 	}
443 
444 	mutex_enter(&p->p_limit->pl_lock);
445 	*alimp = *limp;
446 	mutex_exit(&p->p_limit->pl_lock);
447 	return 0;
448 }
449 
450 int
451 sys_getrlimit(struct lwp *l, const struct sys_getrlimit_args *uap,
452     register_t *retval)
453 {
454 	/* {
455 		syscallarg(int) which;
456 		syscallarg(struct rlimit *) rlp;
457 	} */
458 	struct proc *p = l->l_proc;
459 	int which = SCARG(uap, which);
460 	struct rlimit rl;
461 
462 	if ((u_int)which >= RLIM_NLIMITS)
463 		return EINVAL;
464 
465 	mutex_enter(p->p_lock);
466 	memcpy(&rl, &p->p_rlimit[which], sizeof(rl));
467 	mutex_exit(p->p_lock);
468 
469 	return copyout(&rl, SCARG(uap, rlp), sizeof(rl));
470 }
471 
472 /*
473  * Transform the running time and tick information in proc p into user,
474  * system, and interrupt time usage.
475  *
476  * Should be called with p->p_lock held unless called from exit1().
477  */
478 void
479 calcru(struct proc *p, struct timeval *up, struct timeval *sp,
480     struct timeval *ip, struct timeval *rp)
481 {
482 	uint64_t u, st, ut, it, tot;
483 	struct lwp *l;
484 	struct bintime tm;
485 	struct timeval tv;
486 
487 	KASSERT(p->p_stat == SDEAD || mutex_owned(p->p_lock));
488 
489 	mutex_spin_enter(&p->p_stmutex);
490 	st = p->p_sticks;
491 	ut = p->p_uticks;
492 	it = p->p_iticks;
493 	mutex_spin_exit(&p->p_stmutex);
494 
495 	tm = p->p_rtime;
496 
497 	LIST_FOREACH(l, &p->p_lwps, l_sibling) {
498 		lwp_lock(l);
499 		bintime_add(&tm, &l->l_rtime);
500 		if ((l->l_pflag & LP_RUNNING) != 0) {
501 			struct bintime diff;
502 			/*
503 			 * Adjust for the current time slice.  This is
504 			 * actually fairly important since the error
505 			 * here is on the order of a time quantum,
506 			 * which is much greater than the sampling
507 			 * error.
508 			 */
509 			binuptime(&diff);
510 			bintime_sub(&diff, &l->l_stime);
511 			bintime_add(&tm, &diff);
512 		}
513 		lwp_unlock(l);
514 	}
515 
516 	tot = st + ut + it;
517 	bintime2timeval(&tm, &tv);
518 	u = (uint64_t)tv.tv_sec * 1000000ul + tv.tv_usec;
519 
520 	if (tot == 0) {
521 		/* No ticks, so can't use to share time out, split 50-50 */
522 		st = ut = u / 2;
523 	} else {
524 		st = (u * st) / tot;
525 		ut = (u * ut) / tot;
526 	}
527 	if (sp != NULL) {
528 		sp->tv_sec = st / 1000000;
529 		sp->tv_usec = st % 1000000;
530 	}
531 	if (up != NULL) {
532 		up->tv_sec = ut / 1000000;
533 		up->tv_usec = ut % 1000000;
534 	}
535 	if (ip != NULL) {
536 		if (it != 0)
537 			it = (u * it) / tot;
538 		ip->tv_sec = it / 1000000;
539 		ip->tv_usec = it % 1000000;
540 	}
541 	if (rp != NULL) {
542 		*rp = tv;
543 	}
544 }
545 
546 int
547 sys___getrusage50(struct lwp *l, const struct sys___getrusage50_args *uap,
548     register_t *retval)
549 {
550 	/* {
551 		syscallarg(int) who;
552 		syscallarg(struct rusage *) rusage;
553 	} */
554 	struct rusage ru;
555 	struct proc *p = l->l_proc;
556 
557 	switch (SCARG(uap, who)) {
558 	case RUSAGE_SELF:
559 		mutex_enter(p->p_lock);
560 		memcpy(&ru, &p->p_stats->p_ru, sizeof(ru));
561 		calcru(p, &ru.ru_utime, &ru.ru_stime, NULL, NULL);
562 		rulwps(p, &ru);
563 		mutex_exit(p->p_lock);
564 		break;
565 
566 	case RUSAGE_CHILDREN:
567 		mutex_enter(p->p_lock);
568 		memcpy(&ru, &p->p_stats->p_cru, sizeof(ru));
569 		mutex_exit(p->p_lock);
570 		break;
571 
572 	default:
573 		return EINVAL;
574 	}
575 
576 	return copyout(&ru, SCARG(uap, rusage), sizeof(ru));
577 }
578 
579 void
580 ruadd(struct rusage *ru, struct rusage *ru2)
581 {
582 	long *ip, *ip2;
583 	int i;
584 
585 	timeradd(&ru->ru_utime, &ru2->ru_utime, &ru->ru_utime);
586 	timeradd(&ru->ru_stime, &ru2->ru_stime, &ru->ru_stime);
587 	if (ru->ru_maxrss < ru2->ru_maxrss)
588 		ru->ru_maxrss = ru2->ru_maxrss;
589 	ip = &ru->ru_first; ip2 = &ru2->ru_first;
590 	for (i = &ru->ru_last - &ru->ru_first; i >= 0; i--)
591 		*ip++ += *ip2++;
592 }
593 
594 void
595 rulwps(proc_t *p, struct rusage *ru)
596 {
597 	lwp_t *l;
598 
599 	KASSERT(mutex_owned(p->p_lock));
600 
601 	LIST_FOREACH(l, &p->p_lwps, l_sibling) {
602 		ruadd(ru, &l->l_ru);
603 		ru->ru_nvcsw += (l->l_ncsw - l->l_nivcsw);
604 		ru->ru_nivcsw += l->l_nivcsw;
605 	}
606 }
607 
608 /*
609  * lim_copy: make a copy of the plimit structure.
610  *
611  * We use copy-on-write after fork, and copy when a limit is changed.
612  */
613 struct plimit *
614 lim_copy(struct plimit *lim)
615 {
616 	struct plimit *newlim;
617 	char *corename;
618 	size_t alen, len;
619 
620 	newlim = pool_cache_get(plimit_cache, PR_WAITOK);
621 	mutex_init(&newlim->pl_lock, MUTEX_DEFAULT, IPL_NONE);
622 	newlim->pl_writeable = false;
623 	newlim->pl_refcnt = 1;
624 	newlim->pl_sv_limit = NULL;
625 
626 	mutex_enter(&lim->pl_lock);
627 	memcpy(newlim->pl_rlimit, lim->pl_rlimit,
628 	    sizeof(struct rlimit) * RLIM_NLIMITS);
629 
630 	/*
631 	 * Note: the common case is a use of default core name.
632 	 */
633 	alen = 0;
634 	corename = NULL;
635 	for (;;) {
636 		if (lim->pl_corename == defcorename) {
637 			newlim->pl_corename = defcorename;
638 			newlim->pl_cnlen = 0;
639 			break;
640 		}
641 		len = lim->pl_cnlen;
642 		if (len == alen) {
643 			newlim->pl_corename = corename;
644 			newlim->pl_cnlen = len;
645 			memcpy(corename, lim->pl_corename, len);
646 			corename = NULL;
647 			break;
648 		}
649 		mutex_exit(&lim->pl_lock);
650 		if (corename) {
651 			kmem_free(corename, alen);
652 		}
653 		alen = len;
654 		corename = kmem_alloc(alen, KM_SLEEP);
655 		mutex_enter(&lim->pl_lock);
656 	}
657 	mutex_exit(&lim->pl_lock);
658 
659 	if (corename) {
660 		kmem_free(corename, alen);
661 	}
662 	return newlim;
663 }
664 
665 void
666 lim_addref(struct plimit *lim)
667 {
668 	atomic_inc_uint(&lim->pl_refcnt);
669 }
670 
671 /*
672  * lim_privatise: give a process its own private plimit structure.
673  */
674 void
675 lim_privatise(proc_t *p)
676 {
677 	struct plimit *lim = p->p_limit, *newlim;
678 
679 	if (lim->pl_writeable) {
680 		return;
681 	}
682 
683 	newlim = lim_copy(lim);
684 
685 	mutex_enter(p->p_lock);
686 	if (p->p_limit->pl_writeable) {
687 		/* Other thread won the race. */
688 		mutex_exit(p->p_lock);
689 		lim_free(newlim);
690 		return;
691 	}
692 
693 	/*
694 	 * Since p->p_limit can be accessed without locked held,
695 	 * old limit structure must not be deleted yet.
696 	 */
697 	newlim->pl_sv_limit = p->p_limit;
698 	newlim->pl_writeable = true;
699 	p->p_limit = newlim;
700 	mutex_exit(p->p_lock);
701 }
702 
703 void
704 lim_setcorename(proc_t *p, char *name, size_t len)
705 {
706 	struct plimit *lim;
707 	char *oname;
708 	size_t olen;
709 
710 	lim_privatise(p);
711 	lim = p->p_limit;
712 
713 	mutex_enter(&lim->pl_lock);
714 	oname = lim->pl_corename;
715 	olen = lim->pl_cnlen;
716 	lim->pl_corename = name;
717 	lim->pl_cnlen = len;
718 	mutex_exit(&lim->pl_lock);
719 
720 	if (oname != defcorename) {
721 		kmem_free(oname, olen);
722 	}
723 }
724 
725 void
726 lim_free(struct plimit *lim)
727 {
728 	struct plimit *sv_lim;
729 
730 	do {
731 		if (atomic_dec_uint_nv(&lim->pl_refcnt) > 0) {
732 			return;
733 		}
734 		if (lim->pl_corename != defcorename) {
735 			kmem_free(lim->pl_corename, lim->pl_cnlen);
736 		}
737 		sv_lim = lim->pl_sv_limit;
738 		mutex_destroy(&lim->pl_lock);
739 		pool_cache_put(plimit_cache, lim);
740 	} while ((lim = sv_lim) != NULL);
741 }
742 
743 struct pstats *
744 pstatscopy(struct pstats *ps)
745 {
746 	struct pstats *nps;
747 	size_t len;
748 
749 	nps = pool_cache_get(pstats_cache, PR_WAITOK);
750 
751 	len = (char *)&nps->pstat_endzero - (char *)&nps->pstat_startzero;
752 	memset(&nps->pstat_startzero, 0, len);
753 
754 	len = (char *)&nps->pstat_endcopy - (char *)&nps->pstat_startcopy;
755 	memcpy(&nps->pstat_startcopy, &ps->pstat_startcopy, len);
756 
757 	return nps;
758 }
759 
760 void
761 pstatsfree(struct pstats *ps)
762 {
763 
764 	pool_cache_put(pstats_cache, ps);
765 }
766 
767 /*
768  * sysctl_proc_findproc: a routine for sysctl proc subtree helpers that
769  * need to pick a valid process by PID.
770  *
771  * => Hold a reference on the process, on success.
772  */
773 static int
774 sysctl_proc_findproc(lwp_t *l, pid_t pid, proc_t **p2)
775 {
776 	proc_t *p;
777 	int error;
778 
779 	if (pid == PROC_CURPROC) {
780 		p = l->l_proc;
781 	} else {
782 		mutex_enter(proc_lock);
783 		p = proc_find(pid);
784 		if (p == NULL) {
785 			mutex_exit(proc_lock);
786 			return ESRCH;
787 		}
788 	}
789 	error = rw_tryenter(&p->p_reflock, RW_READER) ? 0 : EBUSY;
790 	if (pid != PROC_CURPROC) {
791 		mutex_exit(proc_lock);
792 	}
793 	*p2 = p;
794 	return error;
795 }
796 
797 /*
798  * sysctl_proc_corename: helper routine to get or set the core file name
799  * for a process specified by PID.
800  */
801 static int
802 sysctl_proc_corename(SYSCTLFN_ARGS)
803 {
804 	struct proc *p;
805 	struct plimit *lim;
806 	char *cnbuf, *cname;
807 	struct sysctlnode node;
808 	size_t len;
809 	int error;
810 
811 	/* First, validate the request. */
812 	if (namelen != 0 || name[-1] != PROC_PID_CORENAME)
813 		return EINVAL;
814 
815 	/* Find the process.  Hold a reference (p_reflock), if found. */
816 	error = sysctl_proc_findproc(l, (pid_t)name[-2], &p);
817 	if (error)
818 		return error;
819 
820 	/* XXX-elad */
821 	error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_CANSEE, p,
822 	    KAUTH_ARG(KAUTH_REQ_PROCESS_CANSEE_ENTRY), NULL, NULL);
823 	if (error) {
824 		rw_exit(&p->p_reflock);
825 		return error;
826 	}
827 
828 	cnbuf = PNBUF_GET();
829 
830 	if (oldp) {
831 		/* Get case: copy the core name into the buffer. */
832 		error = kauth_authorize_process(l->l_cred,
833 		    KAUTH_PROCESS_CORENAME, p,
834 		    KAUTH_ARG(KAUTH_REQ_PROCESS_CORENAME_GET), NULL, NULL);
835 		if (error) {
836 			goto done;
837 		}
838 		lim = p->p_limit;
839 		mutex_enter(&lim->pl_lock);
840 		strlcpy(cnbuf, lim->pl_corename, MAXPATHLEN);
841 		mutex_exit(&lim->pl_lock);
842 	}
843 
844 	node = *rnode;
845 	node.sysctl_data = cnbuf;
846 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
847 
848 	/* Return if error, or if caller is only getting the core name. */
849 	if (error || newp == NULL) {
850 		goto done;
851 	}
852 
853 	/*
854 	 * Set case.  Check permission and then validate new core name.
855 	 * It must be either "core", "/core", or end in ".core".
856 	 */
857 	error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_CORENAME,
858 	    p, KAUTH_ARG(KAUTH_REQ_PROCESS_CORENAME_SET), cnbuf, NULL);
859 	if (error) {
860 		goto done;
861 	}
862 	len = strlen(cnbuf);
863 	if ((len < 4 || strcmp(cnbuf + len - 4, "core") != 0) ||
864 	    (len > 4 && cnbuf[len - 5] != '/' && cnbuf[len - 5] != '.')) {
865 		error = EINVAL;
866 		goto done;
867 	}
868 
869 	/* Allocate, copy and set the new core name for plimit structure. */
870 	cname = kmem_alloc(++len, KM_NOSLEEP);
871 	if (cname == NULL) {
872 		error = ENOMEM;
873 		goto done;
874 	}
875 	memcpy(cname, cnbuf, len);
876 	lim_setcorename(p, cname, len);
877 done:
878 	rw_exit(&p->p_reflock);
879 	PNBUF_PUT(cnbuf);
880 	return error;
881 }
882 
883 /*
884  * sysctl_proc_stop: helper routine for checking/setting the stop flags.
885  */
886 static int
887 sysctl_proc_stop(SYSCTLFN_ARGS)
888 {
889 	struct proc *p;
890 	int isset, flag, error = 0;
891 	struct sysctlnode node;
892 
893 	if (namelen != 0)
894 		return EINVAL;
895 
896 	/* Find the process.  Hold a reference (p_reflock), if found. */
897 	error = sysctl_proc_findproc(l, (pid_t)name[-2], &p);
898 	if (error)
899 		return error;
900 
901 	/* XXX-elad */
902 	error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_CANSEE, p,
903 	    KAUTH_ARG(KAUTH_REQ_PROCESS_CANSEE_ENTRY), NULL, NULL);
904 	if (error) {
905 		goto out;
906 	}
907 
908 	/* Determine the flag. */
909 	switch (rnode->sysctl_num) {
910 	case PROC_PID_STOPFORK:
911 		flag = PS_STOPFORK;
912 		break;
913 	case PROC_PID_STOPEXEC:
914 		flag = PS_STOPEXEC;
915 		break;
916 	case PROC_PID_STOPEXIT:
917 		flag = PS_STOPEXIT;
918 		break;
919 	default:
920 		error = EINVAL;
921 		goto out;
922 	}
923 	isset = (p->p_flag & flag) ? 1 : 0;
924 	node = *rnode;
925 	node.sysctl_data = &isset;
926 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
927 
928 	/* Return if error, or if callers is only getting the flag. */
929 	if (error || newp == NULL) {
930 		goto out;
931 	}
932 
933 	/* Check if caller can set the flags. */
934 	error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_STOPFLAG,
935 	    p, KAUTH_ARG(flag), NULL, NULL);
936 	if (error) {
937 		goto out;
938 	}
939 	mutex_enter(p->p_lock);
940 	if (isset) {
941 		p->p_sflag |= flag;
942 	} else {
943 		p->p_sflag &= ~flag;
944 	}
945 	mutex_exit(p->p_lock);
946 out:
947 	rw_exit(&p->p_reflock);
948 	return error;
949 }
950 
951 /*
952  * sysctl_proc_plimit: helper routine to get/set rlimits of a process.
953  */
954 static int
955 sysctl_proc_plimit(SYSCTLFN_ARGS)
956 {
957 	struct proc *p;
958 	u_int limitno;
959 	int which, error = 0;
960         struct rlimit alim;
961 	struct sysctlnode node;
962 
963 	if (namelen != 0)
964 		return EINVAL;
965 
966 	which = name[-1];
967 	if (which != PROC_PID_LIMIT_TYPE_SOFT &&
968 	    which != PROC_PID_LIMIT_TYPE_HARD)
969 		return EINVAL;
970 
971 	limitno = name[-2] - 1;
972 	if (limitno >= RLIM_NLIMITS)
973 		return EINVAL;
974 
975 	if (name[-3] != PROC_PID_LIMIT)
976 		return EINVAL;
977 
978 	/* Find the process.  Hold a reference (p_reflock), if found. */
979 	error = sysctl_proc_findproc(l, (pid_t)name[-4], &p);
980 	if (error)
981 		return error;
982 
983 	/* XXX-elad */
984 	error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_CANSEE, p,
985 	    KAUTH_ARG(KAUTH_REQ_PROCESS_CANSEE_ENTRY), NULL, NULL);
986 	if (error)
987 		goto out;
988 
989 	/* Check if caller can retrieve the limits. */
990 	if (newp == NULL) {
991 		error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_RLIMIT,
992 		    p, KAUTH_ARG(KAUTH_REQ_PROCESS_RLIMIT_GET), &alim,
993 		    KAUTH_ARG(which));
994 		if (error)
995 			goto out;
996 	}
997 
998 	/* Retrieve the limits. */
999 	node = *rnode;
1000 	memcpy(&alim, &p->p_rlimit[limitno], sizeof(alim));
1001 	if (which == PROC_PID_LIMIT_TYPE_HARD) {
1002 		node.sysctl_data = &alim.rlim_max;
1003 	} else {
1004 		node.sysctl_data = &alim.rlim_cur;
1005 	}
1006 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
1007 
1008 	/* Return if error, or if we are only retrieving the limits. */
1009 	if (error || newp == NULL) {
1010 		goto out;
1011 	}
1012 	error = dosetrlimit(l, p, limitno, &alim);
1013 out:
1014 	rw_exit(&p->p_reflock);
1015 	return error;
1016 }
1017 
1018 /*
1019  * Setup sysctl nodes.
1020  */
1021 static void
1022 sysctl_proc_setup(void)
1023 {
1024 
1025 	sysctl_createv(&proc_sysctllog, 0, NULL, NULL,
1026 		       CTLFLAG_PERMANENT,
1027 		       CTLTYPE_NODE, "proc", NULL,
1028 		       NULL, 0, NULL, 0,
1029 		       CTL_PROC, CTL_EOL);
1030 	sysctl_createv(&proc_sysctllog, 0, NULL, NULL,
1031 		       CTLFLAG_PERMANENT|CTLFLAG_ANYNUMBER,
1032 		       CTLTYPE_NODE, "curproc",
1033 		       SYSCTL_DESCR("Per-process settings"),
1034 		       NULL, 0, NULL, 0,
1035 		       CTL_PROC, PROC_CURPROC, CTL_EOL);
1036 
1037 	sysctl_createv(&proc_sysctllog, 0, NULL, NULL,
1038 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE|CTLFLAG_ANYWRITE,
1039 		       CTLTYPE_STRING, "corename",
1040 		       SYSCTL_DESCR("Core file name"),
1041 		       sysctl_proc_corename, 0, NULL, MAXPATHLEN,
1042 		       CTL_PROC, PROC_CURPROC, PROC_PID_CORENAME, CTL_EOL);
1043 	sysctl_createv(&proc_sysctllog, 0, NULL, NULL,
1044 		       CTLFLAG_PERMANENT,
1045 		       CTLTYPE_NODE, "rlimit",
1046 		       SYSCTL_DESCR("Process limits"),
1047 		       NULL, 0, NULL, 0,
1048 		       CTL_PROC, PROC_CURPROC, PROC_PID_LIMIT, CTL_EOL);
1049 
1050 #define create_proc_plimit(s, n) do {					\
1051 	sysctl_createv(&proc_sysctllog, 0, NULL, NULL,			\
1052 		       CTLFLAG_PERMANENT,				\
1053 		       CTLTYPE_NODE, s,					\
1054 		       SYSCTL_DESCR("Process " s " limits"),		\
1055 		       NULL, 0, NULL, 0,				\
1056 		       CTL_PROC, PROC_CURPROC, PROC_PID_LIMIT, n,	\
1057 		       CTL_EOL);					\
1058 	sysctl_createv(&proc_sysctllog, 0, NULL, NULL,			\
1059 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE|CTLFLAG_ANYWRITE, \
1060 		       CTLTYPE_QUAD, "soft",				\
1061 		       SYSCTL_DESCR("Process soft " s " limit"),	\
1062 		       sysctl_proc_plimit, 0, NULL, 0,			\
1063 		       CTL_PROC, PROC_CURPROC, PROC_PID_LIMIT, n,	\
1064 		       PROC_PID_LIMIT_TYPE_SOFT, CTL_EOL);		\
1065 	sysctl_createv(&proc_sysctllog, 0, NULL, NULL,			\
1066 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE|CTLFLAG_ANYWRITE, \
1067 		       CTLTYPE_QUAD, "hard",				\
1068 		       SYSCTL_DESCR("Process hard " s " limit"),	\
1069 		       sysctl_proc_plimit, 0, NULL, 0,			\
1070 		       CTL_PROC, PROC_CURPROC, PROC_PID_LIMIT, n,	\
1071 		       PROC_PID_LIMIT_TYPE_HARD, CTL_EOL);		\
1072 	} while (0/*CONSTCOND*/)
1073 
1074 	create_proc_plimit("cputime",		PROC_PID_LIMIT_CPU);
1075 	create_proc_plimit("filesize",		PROC_PID_LIMIT_FSIZE);
1076 	create_proc_plimit("datasize",		PROC_PID_LIMIT_DATA);
1077 	create_proc_plimit("stacksize",		PROC_PID_LIMIT_STACK);
1078 	create_proc_plimit("coredumpsize",	PROC_PID_LIMIT_CORE);
1079 	create_proc_plimit("memoryuse",		PROC_PID_LIMIT_RSS);
1080 	create_proc_plimit("memorylocked",	PROC_PID_LIMIT_MEMLOCK);
1081 	create_proc_plimit("maxproc",		PROC_PID_LIMIT_NPROC);
1082 	create_proc_plimit("descriptors",	PROC_PID_LIMIT_NOFILE);
1083 	create_proc_plimit("sbsize",		PROC_PID_LIMIT_SBSIZE);
1084 	create_proc_plimit("vmemoryuse",	PROC_PID_LIMIT_AS);
1085 
1086 #undef create_proc_plimit
1087 
1088 	sysctl_createv(&proc_sysctllog, 0, NULL, NULL,
1089 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE|CTLFLAG_ANYWRITE,
1090 		       CTLTYPE_INT, "stopfork",
1091 		       SYSCTL_DESCR("Stop process at fork(2)"),
1092 		       sysctl_proc_stop, 0, NULL, 0,
1093 		       CTL_PROC, PROC_CURPROC, PROC_PID_STOPFORK, CTL_EOL);
1094 	sysctl_createv(&proc_sysctllog, 0, NULL, NULL,
1095 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE|CTLFLAG_ANYWRITE,
1096 		       CTLTYPE_INT, "stopexec",
1097 		       SYSCTL_DESCR("Stop process at execve(2)"),
1098 		       sysctl_proc_stop, 0, NULL, 0,
1099 		       CTL_PROC, PROC_CURPROC, PROC_PID_STOPEXEC, CTL_EOL);
1100 	sysctl_createv(&proc_sysctllog, 0, NULL, NULL,
1101 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE|CTLFLAG_ANYWRITE,
1102 		       CTLTYPE_INT, "stopexit",
1103 		       SYSCTL_DESCR("Stop process before completing exit"),
1104 		       sysctl_proc_stop, 0, NULL, 0,
1105 		       CTL_PROC, PROC_CURPROC, PROC_PID_STOPEXIT, CTL_EOL);
1106 }
1107