xref: /freebsd/sys/kern/kern_rctl.c (revision 4fe84775390405218ac1e5f46d8e91902bd37587)
1ec125fbbSEdward Tomasz Napierala /*-
2ec125fbbSEdward Tomasz Napierala  * Copyright (c) 2010 The FreeBSD Foundation
3ec125fbbSEdward Tomasz Napierala  * All rights reserved.
4ec125fbbSEdward Tomasz Napierala  *
5ec125fbbSEdward Tomasz Napierala  * This software was developed by Edward Tomasz Napierala under sponsorship
6ec125fbbSEdward Tomasz Napierala  * from the FreeBSD Foundation.
7ec125fbbSEdward Tomasz Napierala  *
8ec125fbbSEdward Tomasz Napierala  * Redistribution and use in source and binary forms, with or without
9ec125fbbSEdward Tomasz Napierala  * modification, are permitted provided that the following conditions
10ec125fbbSEdward Tomasz Napierala  * are met:
11ec125fbbSEdward Tomasz Napierala  * 1. Redistributions of source code must retain the above copyright
12ec125fbbSEdward Tomasz Napierala  *    notice, this list of conditions and the following disclaimer.
13ec125fbbSEdward Tomasz Napierala  * 2. Redistributions in binary form must reproduce the above copyright
14ec125fbbSEdward Tomasz Napierala  *    notice, this list of conditions and the following disclaimer in the
15ec125fbbSEdward Tomasz Napierala  *    documentation and/or other materials provided with the distribution.
16ec125fbbSEdward Tomasz Napierala  *
17ec125fbbSEdward Tomasz Napierala  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18ec125fbbSEdward Tomasz Napierala  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19ec125fbbSEdward Tomasz Napierala  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20ec125fbbSEdward Tomasz Napierala  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21ec125fbbSEdward Tomasz Napierala  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22ec125fbbSEdward Tomasz Napierala  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23ec125fbbSEdward Tomasz Napierala  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24ec125fbbSEdward Tomasz Napierala  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25ec125fbbSEdward Tomasz Napierala  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26ec125fbbSEdward Tomasz Napierala  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27ec125fbbSEdward Tomasz Napierala  * SUCH DAMAGE.
28ec125fbbSEdward Tomasz Napierala  *
29ec125fbbSEdward Tomasz Napierala  * $FreeBSD$
30ec125fbbSEdward Tomasz Napierala  */
31ec125fbbSEdward Tomasz Napierala 
32ec125fbbSEdward Tomasz Napierala #include <sys/cdefs.h>
33ec125fbbSEdward Tomasz Napierala __FBSDID("$FreeBSD$");
34ec125fbbSEdward Tomasz Napierala 
35ec125fbbSEdward Tomasz Napierala #include <sys/param.h>
36ec125fbbSEdward Tomasz Napierala #include <sys/bus.h>
37ec125fbbSEdward Tomasz Napierala #include <sys/malloc.h>
38ec125fbbSEdward Tomasz Napierala #include <sys/queue.h>
39ec125fbbSEdward Tomasz Napierala #include <sys/refcount.h>
40ec125fbbSEdward Tomasz Napierala #include <sys/jail.h>
41ec125fbbSEdward Tomasz Napierala #include <sys/kernel.h>
42ec125fbbSEdward Tomasz Napierala #include <sys/limits.h>
43ec125fbbSEdward Tomasz Napierala #include <sys/loginclass.h>
44ec125fbbSEdward Tomasz Napierala #include <sys/priv.h>
45ec125fbbSEdward Tomasz Napierala #include <sys/proc.h>
46ec125fbbSEdward Tomasz Napierala #include <sys/racct.h>
47ec125fbbSEdward Tomasz Napierala #include <sys/rctl.h>
48ec125fbbSEdward Tomasz Napierala #include <sys/resourcevar.h>
49ec125fbbSEdward Tomasz Napierala #include <sys/sx.h>
50ec125fbbSEdward Tomasz Napierala #include <sys/sysent.h>
51ec125fbbSEdward Tomasz Napierala #include <sys/sysproto.h>
52ec125fbbSEdward Tomasz Napierala #include <sys/systm.h>
53ec125fbbSEdward Tomasz Napierala #include <sys/types.h>
54ec125fbbSEdward Tomasz Napierala #include <sys/eventhandler.h>
55ec125fbbSEdward Tomasz Napierala #include <sys/lock.h>
56ec125fbbSEdward Tomasz Napierala #include <sys/mutex.h>
57ec125fbbSEdward Tomasz Napierala #include <sys/rwlock.h>
58ec125fbbSEdward Tomasz Napierala #include <sys/sbuf.h>
59ec125fbbSEdward Tomasz Napierala #include <sys/taskqueue.h>
60ec125fbbSEdward Tomasz Napierala #include <sys/tree.h>
61ec125fbbSEdward Tomasz Napierala #include <vm/uma.h>
62ec125fbbSEdward Tomasz Napierala 
63ec125fbbSEdward Tomasz Napierala #ifdef RCTL
64ec125fbbSEdward Tomasz Napierala #ifndef RACCT
65ec125fbbSEdward Tomasz Napierala #error "The RCTL option requires the RACCT option"
66ec125fbbSEdward Tomasz Napierala #endif
67ec125fbbSEdward Tomasz Napierala 
68ec125fbbSEdward Tomasz Napierala FEATURE(rctl, "Resource Limits");
69ec125fbbSEdward Tomasz Napierala 
70ec125fbbSEdward Tomasz Napierala #define	HRF_DEFAULT		0
71ec125fbbSEdward Tomasz Napierala #define	HRF_DONT_INHERIT	1
72ec125fbbSEdward Tomasz Napierala #define	HRF_DONT_ACCUMULATE	2
73ec125fbbSEdward Tomasz Napierala 
74ec125fbbSEdward Tomasz Napierala /* Default buffer size for rctl_get_rules(2). */
75ec125fbbSEdward Tomasz Napierala #define	RCTL_DEFAULT_BUFSIZE	4096
76ec125fbbSEdward Tomasz Napierala #define	RCTL_LOG_BUFSIZE	128
77ec125fbbSEdward Tomasz Napierala 
78ec125fbbSEdward Tomasz Napierala /*
79ec125fbbSEdward Tomasz Napierala  * 'rctl_rule_link' connects a rule with every racct it's related to.
80ec125fbbSEdward Tomasz Napierala  * For example, rule 'user:X:openfiles:deny=N/process' is linked
81ec125fbbSEdward Tomasz Napierala  * with uidinfo for user X, and to each process of that user.
82ec125fbbSEdward Tomasz Napierala  */
83ec125fbbSEdward Tomasz Napierala struct rctl_rule_link {
84ec125fbbSEdward Tomasz Napierala 	LIST_ENTRY(rctl_rule_link)	rrl_next;
85ec125fbbSEdward Tomasz Napierala 	struct rctl_rule		*rrl_rule;
86ec125fbbSEdward Tomasz Napierala 	int				rrl_exceeded;
87ec125fbbSEdward Tomasz Napierala };
88ec125fbbSEdward Tomasz Napierala 
89ec125fbbSEdward Tomasz Napierala struct dict {
90ec125fbbSEdward Tomasz Napierala 	const char	*d_name;
91ec125fbbSEdward Tomasz Napierala 	int		d_value;
92ec125fbbSEdward Tomasz Napierala };
93ec125fbbSEdward Tomasz Napierala 
94ec125fbbSEdward Tomasz Napierala static struct dict subjectnames[] = {
95ec125fbbSEdward Tomasz Napierala 	{ "process", RCTL_SUBJECT_TYPE_PROCESS },
96ec125fbbSEdward Tomasz Napierala 	{ "user", RCTL_SUBJECT_TYPE_USER },
97ec125fbbSEdward Tomasz Napierala 	{ "loginclass", RCTL_SUBJECT_TYPE_LOGINCLASS },
98ec125fbbSEdward Tomasz Napierala 	{ "jail", RCTL_SUBJECT_TYPE_JAIL },
99ec125fbbSEdward Tomasz Napierala 	{ NULL, -1 }};
100ec125fbbSEdward Tomasz Napierala 
101ec125fbbSEdward Tomasz Napierala static struct dict resourcenames[] = {
102ec125fbbSEdward Tomasz Napierala 	{ "cpu", RACCT_CPU },
103ec125fbbSEdward Tomasz Napierala 	{ "data", RACCT_DATA },
104ec125fbbSEdward Tomasz Napierala 	{ "stack", RACCT_STACK },
105ec125fbbSEdward Tomasz Napierala 	{ "core", RACCT_CORE },
106ec125fbbSEdward Tomasz Napierala 	{ "rss", RACCT_RSS },
107ec125fbbSEdward Tomasz Napierala 	{ "memlock", RACCT_MEMLOCK },
108ec125fbbSEdward Tomasz Napierala 	{ "nproc", RACCT_NPROC },
109ec125fbbSEdward Tomasz Napierala 	{ "nofile", RACCT_NOFILE },
110ec125fbbSEdward Tomasz Napierala 	{ "vmem", RACCT_VMEM },
111ec125fbbSEdward Tomasz Napierala 	{ "npts", RACCT_NPTS },
112ec125fbbSEdward Tomasz Napierala 	{ "swap", RACCT_SWAP },
113ec125fbbSEdward Tomasz Napierala 	{ "nthr", RACCT_NTHR },
114ec125fbbSEdward Tomasz Napierala 	{ "msgqqueued", RACCT_MSGQQUEUED },
115ec125fbbSEdward Tomasz Napierala 	{ "msgqsize", RACCT_MSGQSIZE },
116ec125fbbSEdward Tomasz Napierala 	{ "nmsgq", RACCT_NMSGQ },
117ec125fbbSEdward Tomasz Napierala 	{ "nsem", RACCT_NSEM },
118ec125fbbSEdward Tomasz Napierala 	{ "nsemop", RACCT_NSEMOP },
119ec125fbbSEdward Tomasz Napierala 	{ "nshm", RACCT_NSHM },
120ec125fbbSEdward Tomasz Napierala 	{ "shmsize", RACCT_SHMSIZE },
121ec125fbbSEdward Tomasz Napierala 	{ "wallclock", RACCT_WALLCLOCK },
122ec125fbbSEdward Tomasz Napierala 	{ NULL, -1 }};
123ec125fbbSEdward Tomasz Napierala 
124ec125fbbSEdward Tomasz Napierala static struct dict actionnames[] = {
125ec125fbbSEdward Tomasz Napierala 	{ "sighup", RCTL_ACTION_SIGHUP },
126ec125fbbSEdward Tomasz Napierala 	{ "sigint", RCTL_ACTION_SIGINT },
127ec125fbbSEdward Tomasz Napierala 	{ "sigquit", RCTL_ACTION_SIGQUIT },
128ec125fbbSEdward Tomasz Napierala 	{ "sigill", RCTL_ACTION_SIGILL },
129ec125fbbSEdward Tomasz Napierala 	{ "sigtrap", RCTL_ACTION_SIGTRAP },
130ec125fbbSEdward Tomasz Napierala 	{ "sigabrt", RCTL_ACTION_SIGABRT },
131ec125fbbSEdward Tomasz Napierala 	{ "sigemt", RCTL_ACTION_SIGEMT },
132ec125fbbSEdward Tomasz Napierala 	{ "sigfpe", RCTL_ACTION_SIGFPE },
133ec125fbbSEdward Tomasz Napierala 	{ "sigkill", RCTL_ACTION_SIGKILL },
134ec125fbbSEdward Tomasz Napierala 	{ "sigbus", RCTL_ACTION_SIGBUS },
135ec125fbbSEdward Tomasz Napierala 	{ "sigsegv", RCTL_ACTION_SIGSEGV },
136ec125fbbSEdward Tomasz Napierala 	{ "sigsys", RCTL_ACTION_SIGSYS },
137ec125fbbSEdward Tomasz Napierala 	{ "sigpipe", RCTL_ACTION_SIGPIPE },
138ec125fbbSEdward Tomasz Napierala 	{ "sigalrm", RCTL_ACTION_SIGALRM },
139ec125fbbSEdward Tomasz Napierala 	{ "sigterm", RCTL_ACTION_SIGTERM },
140ec125fbbSEdward Tomasz Napierala 	{ "sigurg", RCTL_ACTION_SIGURG },
141ec125fbbSEdward Tomasz Napierala 	{ "sigstop", RCTL_ACTION_SIGSTOP },
142ec125fbbSEdward Tomasz Napierala 	{ "sigtstp", RCTL_ACTION_SIGTSTP },
143ec125fbbSEdward Tomasz Napierala 	{ "sigchld", RCTL_ACTION_SIGCHLD },
144ec125fbbSEdward Tomasz Napierala 	{ "sigttin", RCTL_ACTION_SIGTTIN },
145ec125fbbSEdward Tomasz Napierala 	{ "sigttou", RCTL_ACTION_SIGTTOU },
146ec125fbbSEdward Tomasz Napierala 	{ "sigio", RCTL_ACTION_SIGIO },
147ec125fbbSEdward Tomasz Napierala 	{ "sigxcpu", RCTL_ACTION_SIGXCPU },
148ec125fbbSEdward Tomasz Napierala 	{ "sigxfsz", RCTL_ACTION_SIGXFSZ },
149ec125fbbSEdward Tomasz Napierala 	{ "sigvtalrm", RCTL_ACTION_SIGVTALRM },
150ec125fbbSEdward Tomasz Napierala 	{ "sigprof", RCTL_ACTION_SIGPROF },
151ec125fbbSEdward Tomasz Napierala 	{ "sigwinch", RCTL_ACTION_SIGWINCH },
152ec125fbbSEdward Tomasz Napierala 	{ "siginfo", RCTL_ACTION_SIGINFO },
153ec125fbbSEdward Tomasz Napierala 	{ "sigusr1", RCTL_ACTION_SIGUSR1 },
154ec125fbbSEdward Tomasz Napierala 	{ "sigusr2", RCTL_ACTION_SIGUSR2 },
155ec125fbbSEdward Tomasz Napierala 	{ "sigthr", RCTL_ACTION_SIGTHR },
156ec125fbbSEdward Tomasz Napierala 	{ "deny", RCTL_ACTION_DENY },
157ec125fbbSEdward Tomasz Napierala 	{ "log", RCTL_ACTION_LOG },
158ec125fbbSEdward Tomasz Napierala 	{ "devctl", RCTL_ACTION_DEVCTL },
159ec125fbbSEdward Tomasz Napierala 	{ NULL, -1 }};
160ec125fbbSEdward Tomasz Napierala 
161ec125fbbSEdward Tomasz Napierala static void rctl_init(void);
162ec125fbbSEdward Tomasz Napierala SYSINIT(rctl, SI_SUB_RACCT, SI_ORDER_FIRST, rctl_init, NULL);
163ec125fbbSEdward Tomasz Napierala 
164ec125fbbSEdward Tomasz Napierala static uma_zone_t rctl_rule_link_zone;
165ec125fbbSEdward Tomasz Napierala static uma_zone_t rctl_rule_zone;
166ec125fbbSEdward Tomasz Napierala static struct rwlock rctl_lock;
167ec125fbbSEdward Tomasz Napierala RW_SYSINIT(rctl_lock, &rctl_lock, "RCTL lock");
168ec125fbbSEdward Tomasz Napierala 
169ec125fbbSEdward Tomasz Napierala static int rctl_rule_fully_specified(const struct rctl_rule *rule);
170ec125fbbSEdward Tomasz Napierala static void rctl_rule_to_sbuf(struct sbuf *sb, const struct rctl_rule *rule);
171ec125fbbSEdward Tomasz Napierala 
172ec125fbbSEdward Tomasz Napierala MALLOC_DEFINE(M_RCTL, "rctl", "Resource Limits");
173ec125fbbSEdward Tomasz Napierala 
174ec125fbbSEdward Tomasz Napierala static const char *
175ec125fbbSEdward Tomasz Napierala rctl_subject_type_name(int subject)
176ec125fbbSEdward Tomasz Napierala {
177ec125fbbSEdward Tomasz Napierala 	int i;
178ec125fbbSEdward Tomasz Napierala 
179ec125fbbSEdward Tomasz Napierala 	for (i = 0; subjectnames[i].d_name != NULL; i++) {
180ec125fbbSEdward Tomasz Napierala 		if (subjectnames[i].d_value == subject)
181ec125fbbSEdward Tomasz Napierala 			return (subjectnames[i].d_name);
182ec125fbbSEdward Tomasz Napierala 	}
183ec125fbbSEdward Tomasz Napierala 
184ec125fbbSEdward Tomasz Napierala 	panic("rctl_subject_type_name: unknown subject type %d", subject);
185ec125fbbSEdward Tomasz Napierala }
186ec125fbbSEdward Tomasz Napierala 
187ec125fbbSEdward Tomasz Napierala static const char *
188ec125fbbSEdward Tomasz Napierala rctl_action_name(int action)
189ec125fbbSEdward Tomasz Napierala {
190ec125fbbSEdward Tomasz Napierala 	int i;
191ec125fbbSEdward Tomasz Napierala 
192ec125fbbSEdward Tomasz Napierala 	for (i = 0; actionnames[i].d_name != NULL; i++) {
193ec125fbbSEdward Tomasz Napierala 		if (actionnames[i].d_value == action)
194ec125fbbSEdward Tomasz Napierala 			return (actionnames[i].d_name);
195ec125fbbSEdward Tomasz Napierala 	}
196ec125fbbSEdward Tomasz Napierala 
197ec125fbbSEdward Tomasz Napierala 	panic("rctl_action_name: unknown action %d", action);
198ec125fbbSEdward Tomasz Napierala }
199ec125fbbSEdward Tomasz Napierala 
200ec125fbbSEdward Tomasz Napierala const char *
201ec125fbbSEdward Tomasz Napierala rctl_resource_name(int resource)
202ec125fbbSEdward Tomasz Napierala {
203ec125fbbSEdward Tomasz Napierala 	int i;
204ec125fbbSEdward Tomasz Napierala 
205ec125fbbSEdward Tomasz Napierala 	for (i = 0; resourcenames[i].d_name != NULL; i++) {
206ec125fbbSEdward Tomasz Napierala 		if (resourcenames[i].d_value == resource)
207ec125fbbSEdward Tomasz Napierala 			return (resourcenames[i].d_name);
208ec125fbbSEdward Tomasz Napierala 	}
209ec125fbbSEdward Tomasz Napierala 
210ec125fbbSEdward Tomasz Napierala 	panic("rctl_resource_name: unknown resource %d", resource);
211ec125fbbSEdward Tomasz Napierala }
212ec125fbbSEdward Tomasz Napierala 
213ec125fbbSEdward Tomasz Napierala /*
214ec125fbbSEdward Tomasz Napierala  * Return the amount of resource that can be allocated by 'p' before
215ec125fbbSEdward Tomasz Napierala  * hitting 'rule'.
216ec125fbbSEdward Tomasz Napierala  */
217ec125fbbSEdward Tomasz Napierala static int64_t
218ec125fbbSEdward Tomasz Napierala rctl_available_resource(const struct proc *p, const struct rctl_rule *rule)
219ec125fbbSEdward Tomasz Napierala {
220ec125fbbSEdward Tomasz Napierala 	int resource;
221ec125fbbSEdward Tomasz Napierala 	int64_t available = INT64_MAX;
222ec125fbbSEdward Tomasz Napierala 	struct ucred *cred = p->p_ucred;
223ec125fbbSEdward Tomasz Napierala 
224ec125fbbSEdward Tomasz Napierala 	rw_assert(&rctl_lock, RA_LOCKED);
225ec125fbbSEdward Tomasz Napierala 
226ec125fbbSEdward Tomasz Napierala 	resource = rule->rr_resource;
227ec125fbbSEdward Tomasz Napierala 	switch (rule->rr_per) {
228ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_PROCESS:
229ec125fbbSEdward Tomasz Napierala 		available = rule->rr_amount -
230ec125fbbSEdward Tomasz Napierala 		    p->p_racct->r_resources[resource];
231ec125fbbSEdward Tomasz Napierala 		break;
232ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_USER:
233ec125fbbSEdward Tomasz Napierala 		available = rule->rr_amount -
234ec125fbbSEdward Tomasz Napierala 		    cred->cr_ruidinfo->ui_racct->r_resources[resource];
235ec125fbbSEdward Tomasz Napierala 		break;
236ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_LOGINCLASS:
237ec125fbbSEdward Tomasz Napierala 		available = rule->rr_amount -
238ec125fbbSEdward Tomasz Napierala 		    cred->cr_loginclass->lc_racct->r_resources[resource];
239ec125fbbSEdward Tomasz Napierala 		break;
240ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_JAIL:
241ec125fbbSEdward Tomasz Napierala 		available = rule->rr_amount -
242a7ad07bfSEdward Tomasz Napierala 		    cred->cr_prison->pr_prison_racct->prr_racct->
243a7ad07bfSEdward Tomasz Napierala 		        r_resources[resource];
244ec125fbbSEdward Tomasz Napierala 		break;
245ec125fbbSEdward Tomasz Napierala 	default:
246ec125fbbSEdward Tomasz Napierala 		panic("rctl_compute_available: unknown per %d",
247ec125fbbSEdward Tomasz Napierala 		    rule->rr_per);
248ec125fbbSEdward Tomasz Napierala 	}
249ec125fbbSEdward Tomasz Napierala 
250ec125fbbSEdward Tomasz Napierala 	return (available);
251ec125fbbSEdward Tomasz Napierala }
252ec125fbbSEdward Tomasz Napierala 
253ec125fbbSEdward Tomasz Napierala /*
254ec125fbbSEdward Tomasz Napierala  * Return non-zero if allocating 'amount' by proc 'p' would exceed
255ec125fbbSEdward Tomasz Napierala  * resource limit specified by 'rule'.
256ec125fbbSEdward Tomasz Napierala  */
257ec125fbbSEdward Tomasz Napierala static int
258ec125fbbSEdward Tomasz Napierala rctl_would_exceed(const struct proc *p, const struct rctl_rule *rule,
259ec125fbbSEdward Tomasz Napierala     int64_t amount)
260ec125fbbSEdward Tomasz Napierala {
261ec125fbbSEdward Tomasz Napierala 	int64_t available;
262ec125fbbSEdward Tomasz Napierala 
263ec125fbbSEdward Tomasz Napierala 	rw_assert(&rctl_lock, RA_LOCKED);
264ec125fbbSEdward Tomasz Napierala 
265ec125fbbSEdward Tomasz Napierala 	available = rctl_available_resource(p, rule);
266ec125fbbSEdward Tomasz Napierala 	if (available >= amount)
267ec125fbbSEdward Tomasz Napierala 		return (0);
268ec125fbbSEdward Tomasz Napierala 
269ec125fbbSEdward Tomasz Napierala 	return (1);
270ec125fbbSEdward Tomasz Napierala }
271ec125fbbSEdward Tomasz Napierala 
272ec125fbbSEdward Tomasz Napierala /*
273ec125fbbSEdward Tomasz Napierala  * Check whether the proc 'p' can allocate 'amount' of 'resource' in addition
274ec125fbbSEdward Tomasz Napierala  * to what it keeps allocated now.  Returns non-zero if the allocation should
275ec125fbbSEdward Tomasz Napierala  * be denied, 0 otherwise.
276ec125fbbSEdward Tomasz Napierala  */
277ec125fbbSEdward Tomasz Napierala int
278ec125fbbSEdward Tomasz Napierala rctl_enforce(struct proc *p, int resource, uint64_t amount)
279ec125fbbSEdward Tomasz Napierala {
280ec125fbbSEdward Tomasz Napierala 	struct rctl_rule *rule;
281ec125fbbSEdward Tomasz Napierala 	struct rctl_rule_link *link;
282ec125fbbSEdward Tomasz Napierala 	struct sbuf sb;
283ec125fbbSEdward Tomasz Napierala 	int should_deny = 0;
284ec125fbbSEdward Tomasz Napierala 	char *buf;
285ec125fbbSEdward Tomasz Napierala 	static int curtime = 0;
286ec125fbbSEdward Tomasz Napierala 	static struct timeval lasttime;
287ec125fbbSEdward Tomasz Napierala 
288ec125fbbSEdward Tomasz Napierala 	rw_rlock(&rctl_lock);
289ec125fbbSEdward Tomasz Napierala 
290ec125fbbSEdward Tomasz Napierala 	/*
291ec125fbbSEdward Tomasz Napierala 	 * There may be more than one matching rule; go through all of them.
292ec125fbbSEdward Tomasz Napierala 	 * Denial should be done last, after logging and sending signals.
293ec125fbbSEdward Tomasz Napierala 	 */
294ec125fbbSEdward Tomasz Napierala 	LIST_FOREACH(link, &p->p_racct->r_rule_links, rrl_next) {
295ec125fbbSEdward Tomasz Napierala 		rule = link->rrl_rule;
296ec125fbbSEdward Tomasz Napierala 		if (rule->rr_resource != resource)
297ec125fbbSEdward Tomasz Napierala 			continue;
298ec125fbbSEdward Tomasz Napierala 		if (!rctl_would_exceed(p, rule, amount)) {
299ec125fbbSEdward Tomasz Napierala 			link->rrl_exceeded = 0;
300ec125fbbSEdward Tomasz Napierala 			continue;
301ec125fbbSEdward Tomasz Napierala 		}
302ec125fbbSEdward Tomasz Napierala 
303ec125fbbSEdward Tomasz Napierala 		switch (rule->rr_action) {
304ec125fbbSEdward Tomasz Napierala 		case RCTL_ACTION_DENY:
305ec125fbbSEdward Tomasz Napierala 			should_deny = 1;
306ec125fbbSEdward Tomasz Napierala 			continue;
307ec125fbbSEdward Tomasz Napierala 		case RCTL_ACTION_LOG:
308ec125fbbSEdward Tomasz Napierala 			/*
309ec125fbbSEdward Tomasz Napierala 			 * If rrl_exceeded != 0, it means we've already
310ec125fbbSEdward Tomasz Napierala 			 * logged a warning for this process.
311ec125fbbSEdward Tomasz Napierala 			 */
312ec125fbbSEdward Tomasz Napierala 			if (link->rrl_exceeded != 0)
313ec125fbbSEdward Tomasz Napierala 				continue;
314ec125fbbSEdward Tomasz Napierala 
315ec125fbbSEdward Tomasz Napierala 			if (!ppsratecheck(&lasttime, &curtime, 10))
316ec125fbbSEdward Tomasz Napierala 				continue;
317ec125fbbSEdward Tomasz Napierala 
318ec125fbbSEdward Tomasz Napierala 			buf = malloc(RCTL_LOG_BUFSIZE, M_RCTL, M_NOWAIT);
319ec125fbbSEdward Tomasz Napierala 			if (buf == NULL) {
320ec125fbbSEdward Tomasz Napierala 				printf("rctl_enforce: out of memory\n");
321ec125fbbSEdward Tomasz Napierala 				continue;
322ec125fbbSEdward Tomasz Napierala 			}
323ec125fbbSEdward Tomasz Napierala 			sbuf_new(&sb, buf, RCTL_LOG_BUFSIZE, SBUF_FIXEDLEN);
324ec125fbbSEdward Tomasz Napierala 			rctl_rule_to_sbuf(&sb, rule);
325ec125fbbSEdward Tomasz Napierala 			sbuf_finish(&sb);
326ec125fbbSEdward Tomasz Napierala 			printf("rctl: rule \"%s\" matched by pid %d "
327ec125fbbSEdward Tomasz Napierala 			    "(%s), uid %d, jail %s\n", sbuf_data(&sb),
328ec125fbbSEdward Tomasz Napierala 			    p->p_pid, p->p_comm, p->p_ucred->cr_uid,
329a7ad07bfSEdward Tomasz Napierala 			    p->p_ucred->cr_prison->pr_prison_racct->prr_name);
330ec125fbbSEdward Tomasz Napierala 			sbuf_delete(&sb);
331ec125fbbSEdward Tomasz Napierala 			free(buf, M_RCTL);
332ec125fbbSEdward Tomasz Napierala 			link->rrl_exceeded = 1;
333ec125fbbSEdward Tomasz Napierala 			continue;
334ec125fbbSEdward Tomasz Napierala 		case RCTL_ACTION_DEVCTL:
335ec125fbbSEdward Tomasz Napierala 			if (link->rrl_exceeded != 0)
336ec125fbbSEdward Tomasz Napierala 				continue;
337ec125fbbSEdward Tomasz Napierala 
338ec125fbbSEdward Tomasz Napierala 			buf = malloc(RCTL_LOG_BUFSIZE, M_RCTL, M_NOWAIT);
339ec125fbbSEdward Tomasz Napierala 			if (buf == NULL) {
340ec125fbbSEdward Tomasz Napierala 				printf("rctl_enforce: out of memory\n");
341ec125fbbSEdward Tomasz Napierala 				continue;
342ec125fbbSEdward Tomasz Napierala 			}
343ec125fbbSEdward Tomasz Napierala 			sbuf_new(&sb, buf, RCTL_LOG_BUFSIZE, SBUF_FIXEDLEN);
344ec125fbbSEdward Tomasz Napierala 			sbuf_printf(&sb, "rule=");
345ec125fbbSEdward Tomasz Napierala 			rctl_rule_to_sbuf(&sb, rule);
346ec125fbbSEdward Tomasz Napierala 			sbuf_printf(&sb, " pid=%d ruid=%d jail=%s",
347ec125fbbSEdward Tomasz Napierala 			    p->p_pid, p->p_ucred->cr_ruid,
348a7ad07bfSEdward Tomasz Napierala 			    p->p_ucred->cr_prison->pr_prison_racct->prr_name);
349ec125fbbSEdward Tomasz Napierala 			sbuf_finish(&sb);
350ec125fbbSEdward Tomasz Napierala 			devctl_notify_f("RCTL", "rule", "matched",
351ec125fbbSEdward Tomasz Napierala 			    sbuf_data(&sb), M_NOWAIT);
352ec125fbbSEdward Tomasz Napierala 			sbuf_delete(&sb);
353ec125fbbSEdward Tomasz Napierala 			free(buf, M_RCTL);
354ec125fbbSEdward Tomasz Napierala 			link->rrl_exceeded = 1;
355ec125fbbSEdward Tomasz Napierala 			continue;
356ec125fbbSEdward Tomasz Napierala 		default:
357ec125fbbSEdward Tomasz Napierala 			if (link->rrl_exceeded != 0)
358ec125fbbSEdward Tomasz Napierala 				continue;
359ec125fbbSEdward Tomasz Napierala 
360ec125fbbSEdward Tomasz Napierala 			KASSERT(rule->rr_action > 0 &&
361ec125fbbSEdward Tomasz Napierala 			    rule->rr_action <= RCTL_ACTION_SIGNAL_MAX,
362ec125fbbSEdward Tomasz Napierala 			    ("rctl_enforce: unknown action %d",
363ec125fbbSEdward Tomasz Napierala 			     rule->rr_action));
364ec125fbbSEdward Tomasz Napierala 
365ec125fbbSEdward Tomasz Napierala 			/*
366ec125fbbSEdward Tomasz Napierala 			 * We're using the fact that RCTL_ACTION_SIG* values
367ec125fbbSEdward Tomasz Napierala 			 * are equal to their counterparts from sys/signal.h.
368ec125fbbSEdward Tomasz Napierala 			 */
369ec125fbbSEdward Tomasz Napierala 			psignal(p, rule->rr_action);
370ec125fbbSEdward Tomasz Napierala 			link->rrl_exceeded = 1;
371ec125fbbSEdward Tomasz Napierala 			continue;
372ec125fbbSEdward Tomasz Napierala 		}
373ec125fbbSEdward Tomasz Napierala 	}
374ec125fbbSEdward Tomasz Napierala 
375ec125fbbSEdward Tomasz Napierala 	rw_runlock(&rctl_lock);
376ec125fbbSEdward Tomasz Napierala 
377ec125fbbSEdward Tomasz Napierala 	if (should_deny) {
378ec125fbbSEdward Tomasz Napierala 		/*
379ec125fbbSEdward Tomasz Napierala 		 * Return fake error code; the caller should change it
380ec125fbbSEdward Tomasz Napierala 		 * into one proper for the situation - EFSIZ, ENOMEM etc.
381ec125fbbSEdward Tomasz Napierala 		 */
382ec125fbbSEdward Tomasz Napierala 		return (EDOOFUS);
383ec125fbbSEdward Tomasz Napierala 	}
384ec125fbbSEdward Tomasz Napierala 
385ec125fbbSEdward Tomasz Napierala 	return (0);
386ec125fbbSEdward Tomasz Napierala }
387ec125fbbSEdward Tomasz Napierala 
388ec125fbbSEdward Tomasz Napierala uint64_t
389ec125fbbSEdward Tomasz Napierala rctl_get_limit(struct proc *p, int resource)
390ec125fbbSEdward Tomasz Napierala {
391ec125fbbSEdward Tomasz Napierala 	struct rctl_rule *rule;
392ec125fbbSEdward Tomasz Napierala 	struct rctl_rule_link *link;
393ec125fbbSEdward Tomasz Napierala 	uint64_t amount = UINT64_MAX;
394ec125fbbSEdward Tomasz Napierala 
395ec125fbbSEdward Tomasz Napierala 	rw_rlock(&rctl_lock);
396ec125fbbSEdward Tomasz Napierala 
397ec125fbbSEdward Tomasz Napierala 	/*
398ec125fbbSEdward Tomasz Napierala 	 * There may be more than one matching rule; go through all of them.
399ec125fbbSEdward Tomasz Napierala 	 * Denial should be done last, after logging and sending signals.
400ec125fbbSEdward Tomasz Napierala 	 */
401ec125fbbSEdward Tomasz Napierala 	LIST_FOREACH(link, &p->p_racct->r_rule_links, rrl_next) {
402ec125fbbSEdward Tomasz Napierala 		rule = link->rrl_rule;
403ec125fbbSEdward Tomasz Napierala 		if (rule->rr_resource != resource)
404ec125fbbSEdward Tomasz Napierala 			continue;
405ec125fbbSEdward Tomasz Napierala 		if (rule->rr_action != RCTL_ACTION_DENY)
406ec125fbbSEdward Tomasz Napierala 			continue;
407ec125fbbSEdward Tomasz Napierala 		if (rule->rr_amount < amount)
408ec125fbbSEdward Tomasz Napierala 			amount = rule->rr_amount;
409ec125fbbSEdward Tomasz Napierala 	}
410ec125fbbSEdward Tomasz Napierala 
411ec125fbbSEdward Tomasz Napierala 	rw_runlock(&rctl_lock);
412ec125fbbSEdward Tomasz Napierala 
413ec125fbbSEdward Tomasz Napierala 	return (amount);
414ec125fbbSEdward Tomasz Napierala }
415ec125fbbSEdward Tomasz Napierala 
416ec125fbbSEdward Tomasz Napierala uint64_t
417ec125fbbSEdward Tomasz Napierala rctl_get_available(struct proc *p, int resource)
418ec125fbbSEdward Tomasz Napierala {
419ec125fbbSEdward Tomasz Napierala 	struct rctl_rule *rule;
420ec125fbbSEdward Tomasz Napierala 	struct rctl_rule_link *link;
421ec125fbbSEdward Tomasz Napierala 	int64_t available, minavailable, allocated;
422ec125fbbSEdward Tomasz Napierala 
423ec125fbbSEdward Tomasz Napierala 	minavailable = INT64_MAX;
424ec125fbbSEdward Tomasz Napierala 
425ec125fbbSEdward Tomasz Napierala 	rw_rlock(&rctl_lock);
426ec125fbbSEdward Tomasz Napierala 
427ec125fbbSEdward Tomasz Napierala 	/*
428ec125fbbSEdward Tomasz Napierala 	 * There may be more than one matching rule; go through all of them.
429ec125fbbSEdward Tomasz Napierala 	 * Denial should be done last, after logging and sending signals.
430ec125fbbSEdward Tomasz Napierala 	 */
431ec125fbbSEdward Tomasz Napierala 	LIST_FOREACH(link, &p->p_racct->r_rule_links, rrl_next) {
432ec125fbbSEdward Tomasz Napierala 		rule = link->rrl_rule;
433ec125fbbSEdward Tomasz Napierala 		if (rule->rr_resource != resource)
434ec125fbbSEdward Tomasz Napierala 			continue;
435ec125fbbSEdward Tomasz Napierala 		if (rule->rr_action != RCTL_ACTION_DENY)
436ec125fbbSEdward Tomasz Napierala 			continue;
437ec125fbbSEdward Tomasz Napierala 		available = rctl_available_resource(p, rule);
438ec125fbbSEdward Tomasz Napierala 		if (available < minavailable)
439ec125fbbSEdward Tomasz Napierala 			minavailable = available;
440ec125fbbSEdward Tomasz Napierala 	}
441ec125fbbSEdward Tomasz Napierala 
442ec125fbbSEdward Tomasz Napierala 	rw_runlock(&rctl_lock);
443ec125fbbSEdward Tomasz Napierala 
444ec125fbbSEdward Tomasz Napierala 	/*
445ec125fbbSEdward Tomasz Napierala 	 * XXX: Think about this _hard_.
446ec125fbbSEdward Tomasz Napierala 	 */
447ec125fbbSEdward Tomasz Napierala 	allocated = p->p_racct->r_resources[resource];
448ec125fbbSEdward Tomasz Napierala 	if (minavailable < INT64_MAX - allocated)
449ec125fbbSEdward Tomasz Napierala 		minavailable += allocated;
450ec125fbbSEdward Tomasz Napierala 	if (minavailable < 0)
451ec125fbbSEdward Tomasz Napierala 		minavailable = 0;
452ec125fbbSEdward Tomasz Napierala 	return (minavailable);
453ec125fbbSEdward Tomasz Napierala }
454ec125fbbSEdward Tomasz Napierala 
455ec125fbbSEdward Tomasz Napierala static int
456ec125fbbSEdward Tomasz Napierala rctl_rule_matches(const struct rctl_rule *rule, const struct rctl_rule *filter)
457ec125fbbSEdward Tomasz Napierala {
458ec125fbbSEdward Tomasz Napierala 
459ec125fbbSEdward Tomasz Napierala 	if (filter->rr_subject_type != RCTL_SUBJECT_TYPE_UNDEFINED) {
460ec125fbbSEdward Tomasz Napierala 		if (rule->rr_subject_type != filter->rr_subject_type)
461ec125fbbSEdward Tomasz Napierala 			return (0);
462ec125fbbSEdward Tomasz Napierala 
463ec125fbbSEdward Tomasz Napierala 		switch (filter->rr_subject_type) {
464ec125fbbSEdward Tomasz Napierala 		case RCTL_SUBJECT_TYPE_PROCESS:
465ec125fbbSEdward Tomasz Napierala 			if (filter->rr_subject.rs_proc != NULL &&
466ec125fbbSEdward Tomasz Napierala 			    rule->rr_subject.rs_proc !=
467ec125fbbSEdward Tomasz Napierala 			    filter->rr_subject.rs_proc)
468ec125fbbSEdward Tomasz Napierala 				return (0);
469ec125fbbSEdward Tomasz Napierala 			break;
470ec125fbbSEdward Tomasz Napierala 		case RCTL_SUBJECT_TYPE_USER:
471ec125fbbSEdward Tomasz Napierala 			if (filter->rr_subject.rs_uip != NULL &&
472ec125fbbSEdward Tomasz Napierala 			    rule->rr_subject.rs_uip !=
473ec125fbbSEdward Tomasz Napierala 			    filter->rr_subject.rs_uip)
474ec125fbbSEdward Tomasz Napierala 				return (0);
475ec125fbbSEdward Tomasz Napierala 			break;
476ec125fbbSEdward Tomasz Napierala 		case RCTL_SUBJECT_TYPE_LOGINCLASS:
477415896e3SEdward Tomasz Napierala 			if (filter->rr_subject.rs_loginclass != NULL &&
478415896e3SEdward Tomasz Napierala 			    rule->rr_subject.rs_loginclass !=
479415896e3SEdward Tomasz Napierala 			    filter->rr_subject.rs_loginclass)
480ec125fbbSEdward Tomasz Napierala 				return (0);
481ec125fbbSEdward Tomasz Napierala 			break;
482ec125fbbSEdward Tomasz Napierala 		case RCTL_SUBJECT_TYPE_JAIL:
483a7ad07bfSEdward Tomasz Napierala 			if (filter->rr_subject.rs_prison_racct != NULL &&
484a7ad07bfSEdward Tomasz Napierala 			    rule->rr_subject.rs_prison_racct !=
485a7ad07bfSEdward Tomasz Napierala 			    filter->rr_subject.rs_prison_racct)
486ec125fbbSEdward Tomasz Napierala 				return (0);
487ec125fbbSEdward Tomasz Napierala 			break;
488ec125fbbSEdward Tomasz Napierala 		default:
489ec125fbbSEdward Tomasz Napierala 			panic("rctl_rule_matches: unknown subject type %d",
490ec125fbbSEdward Tomasz Napierala 			    filter->rr_subject_type);
491ec125fbbSEdward Tomasz Napierala 		}
492ec125fbbSEdward Tomasz Napierala 	}
493ec125fbbSEdward Tomasz Napierala 
494ec125fbbSEdward Tomasz Napierala 	if (filter->rr_resource != RACCT_UNDEFINED) {
495ec125fbbSEdward Tomasz Napierala 		if (rule->rr_resource != filter->rr_resource)
496ec125fbbSEdward Tomasz Napierala 			return (0);
497ec125fbbSEdward Tomasz Napierala 	}
498ec125fbbSEdward Tomasz Napierala 
499ec125fbbSEdward Tomasz Napierala 	if (filter->rr_action != RCTL_ACTION_UNDEFINED) {
500ec125fbbSEdward Tomasz Napierala 		if (rule->rr_action != filter->rr_action)
501ec125fbbSEdward Tomasz Napierala 			return (0);
502ec125fbbSEdward Tomasz Napierala 	}
503ec125fbbSEdward Tomasz Napierala 
504ec125fbbSEdward Tomasz Napierala 	if (filter->rr_amount != RCTL_AMOUNT_UNDEFINED) {
505ec125fbbSEdward Tomasz Napierala 		if (rule->rr_amount != filter->rr_amount)
506ec125fbbSEdward Tomasz Napierala 			return (0);
507ec125fbbSEdward Tomasz Napierala 	}
508ec125fbbSEdward Tomasz Napierala 
509ec125fbbSEdward Tomasz Napierala 	if (filter->rr_per != RCTL_SUBJECT_TYPE_UNDEFINED) {
510ec125fbbSEdward Tomasz Napierala 		if (rule->rr_per != filter->rr_per)
511ec125fbbSEdward Tomasz Napierala 			return (0);
512ec125fbbSEdward Tomasz Napierala 	}
513ec125fbbSEdward Tomasz Napierala 
514ec125fbbSEdward Tomasz Napierala 	return (1);
515ec125fbbSEdward Tomasz Napierala }
516ec125fbbSEdward Tomasz Napierala 
517ec125fbbSEdward Tomasz Napierala static int
518ec125fbbSEdward Tomasz Napierala str2value(const char *str, int *value, struct dict *table)
519ec125fbbSEdward Tomasz Napierala {
520ec125fbbSEdward Tomasz Napierala 	int i;
521ec125fbbSEdward Tomasz Napierala 
522ec125fbbSEdward Tomasz Napierala 	if (value == NULL)
523ec125fbbSEdward Tomasz Napierala 		return (EINVAL);
524ec125fbbSEdward Tomasz Napierala 
525ec125fbbSEdward Tomasz Napierala 	for (i = 0; table[i].d_name != NULL; i++) {
526ec125fbbSEdward Tomasz Napierala 		if (strcasecmp(table[i].d_name, str) == 0) {
527ec125fbbSEdward Tomasz Napierala 			*value =  table[i].d_value;
528ec125fbbSEdward Tomasz Napierala 			return (0);
529ec125fbbSEdward Tomasz Napierala 		}
530ec125fbbSEdward Tomasz Napierala 	}
531ec125fbbSEdward Tomasz Napierala 
532ec125fbbSEdward Tomasz Napierala 	return (EINVAL);
533ec125fbbSEdward Tomasz Napierala }
534ec125fbbSEdward Tomasz Napierala 
535ec125fbbSEdward Tomasz Napierala static int
536ec125fbbSEdward Tomasz Napierala str2id(const char *str, id_t *value)
537ec125fbbSEdward Tomasz Napierala {
538ec125fbbSEdward Tomasz Napierala 	char *end;
539ec125fbbSEdward Tomasz Napierala 
540ec125fbbSEdward Tomasz Napierala 	if (str == NULL)
541ec125fbbSEdward Tomasz Napierala 		return (EINVAL);
542ec125fbbSEdward Tomasz Napierala 
543ec125fbbSEdward Tomasz Napierala 	*value = strtoul(str, &end, 10);
544ec125fbbSEdward Tomasz Napierala 	if ((size_t)(end - str) != strlen(str))
545ec125fbbSEdward Tomasz Napierala 		return (EINVAL);
546ec125fbbSEdward Tomasz Napierala 
547ec125fbbSEdward Tomasz Napierala 	return (0);
548ec125fbbSEdward Tomasz Napierala }
549ec125fbbSEdward Tomasz Napierala 
550ec125fbbSEdward Tomasz Napierala static int
551ec125fbbSEdward Tomasz Napierala str2int64(const char *str, int64_t *value)
552ec125fbbSEdward Tomasz Napierala {
553ec125fbbSEdward Tomasz Napierala 	char *end;
554ec125fbbSEdward Tomasz Napierala 
555ec125fbbSEdward Tomasz Napierala 	if (str == NULL)
556ec125fbbSEdward Tomasz Napierala 		return (EINVAL);
557ec125fbbSEdward Tomasz Napierala 
558ec125fbbSEdward Tomasz Napierala 	*value = strtoul(str, &end, 10);
559ec125fbbSEdward Tomasz Napierala 	if ((size_t)(end - str) != strlen(str))
560ec125fbbSEdward Tomasz Napierala 		return (EINVAL);
561ec125fbbSEdward Tomasz Napierala 
562ec125fbbSEdward Tomasz Napierala 	return (0);
563ec125fbbSEdward Tomasz Napierala }
564ec125fbbSEdward Tomasz Napierala 
565ec125fbbSEdward Tomasz Napierala /*
566ec125fbbSEdward Tomasz Napierala  * Connect the rule to the racct, increasing refcount for the rule.
567ec125fbbSEdward Tomasz Napierala  */
568ec125fbbSEdward Tomasz Napierala static void
569ec125fbbSEdward Tomasz Napierala rctl_racct_add_rule(struct racct *racct, struct rctl_rule *rule)
570ec125fbbSEdward Tomasz Napierala {
571ec125fbbSEdward Tomasz Napierala 	struct rctl_rule_link *link;
572ec125fbbSEdward Tomasz Napierala 
573ec125fbbSEdward Tomasz Napierala 	KASSERT(rctl_rule_fully_specified(rule), ("rule not fully specified"));
574ec125fbbSEdward Tomasz Napierala 
575ec125fbbSEdward Tomasz Napierala 	rctl_rule_acquire(rule);
576ec125fbbSEdward Tomasz Napierala 	link = uma_zalloc(rctl_rule_link_zone, M_WAITOK);
577ec125fbbSEdward Tomasz Napierala 	link->rrl_rule = rule;
578ec125fbbSEdward Tomasz Napierala 	link->rrl_exceeded = 0;
579ec125fbbSEdward Tomasz Napierala 
580ec125fbbSEdward Tomasz Napierala 	rw_wlock(&rctl_lock);
581ec125fbbSEdward Tomasz Napierala 	LIST_INSERT_HEAD(&racct->r_rule_links, link, rrl_next);
582ec125fbbSEdward Tomasz Napierala 	rw_wunlock(&rctl_lock);
583ec125fbbSEdward Tomasz Napierala }
584ec125fbbSEdward Tomasz Napierala 
585ec125fbbSEdward Tomasz Napierala static int
586ec125fbbSEdward Tomasz Napierala rctl_racct_add_rule_locked(struct racct *racct, struct rctl_rule *rule)
587ec125fbbSEdward Tomasz Napierala {
588ec125fbbSEdward Tomasz Napierala 	struct rctl_rule_link *link;
589ec125fbbSEdward Tomasz Napierala 
590ec125fbbSEdward Tomasz Napierala 	KASSERT(rctl_rule_fully_specified(rule), ("rule not fully specified"));
591ec125fbbSEdward Tomasz Napierala 	rw_assert(&rctl_lock, RA_WLOCKED);
592ec125fbbSEdward Tomasz Napierala 
593ec125fbbSEdward Tomasz Napierala 	link = uma_zalloc(rctl_rule_link_zone, M_NOWAIT);
594ec125fbbSEdward Tomasz Napierala 	if (link == NULL)
595ec125fbbSEdward Tomasz Napierala 		return (ENOMEM);
596ec125fbbSEdward Tomasz Napierala 	rctl_rule_acquire(rule);
597ec125fbbSEdward Tomasz Napierala 	link->rrl_rule = rule;
598ec125fbbSEdward Tomasz Napierala 	link->rrl_exceeded = 0;
599ec125fbbSEdward Tomasz Napierala 
600ec125fbbSEdward Tomasz Napierala 	LIST_INSERT_HEAD(&racct->r_rule_links, link, rrl_next);
601ec125fbbSEdward Tomasz Napierala 	return (0);
602ec125fbbSEdward Tomasz Napierala }
603ec125fbbSEdward Tomasz Napierala 
604ec125fbbSEdward Tomasz Napierala /*
605ec125fbbSEdward Tomasz Napierala  * Remove limits for a rules matching the filter and release
606ec125fbbSEdward Tomasz Napierala  * the refcounts for the rules, possibly freeing them.  Returns
607ec125fbbSEdward Tomasz Napierala  * the number of limit structures removed.
608ec125fbbSEdward Tomasz Napierala  */
609ec125fbbSEdward Tomasz Napierala static int
610ec125fbbSEdward Tomasz Napierala rctl_racct_remove_rules(struct racct *racct,
611ec125fbbSEdward Tomasz Napierala     const struct rctl_rule *filter)
612ec125fbbSEdward Tomasz Napierala {
613ec125fbbSEdward Tomasz Napierala 	int removed = 0;
614ec125fbbSEdward Tomasz Napierala 	struct rctl_rule_link *link, *linktmp;
615ec125fbbSEdward Tomasz Napierala 
616ec125fbbSEdward Tomasz Napierala 	rw_assert(&rctl_lock, RA_WLOCKED);
617ec125fbbSEdward Tomasz Napierala 
618ec125fbbSEdward Tomasz Napierala 	LIST_FOREACH_SAFE(link, &racct->r_rule_links, rrl_next, linktmp) {
619ec125fbbSEdward Tomasz Napierala 		if (!rctl_rule_matches(link->rrl_rule, filter))
620ec125fbbSEdward Tomasz Napierala 			continue;
621ec125fbbSEdward Tomasz Napierala 
622ec125fbbSEdward Tomasz Napierala 		LIST_REMOVE(link, rrl_next);
623ec125fbbSEdward Tomasz Napierala 		rctl_rule_release(link->rrl_rule);
624ec125fbbSEdward Tomasz Napierala 		uma_zfree(rctl_rule_link_zone, link);
625ec125fbbSEdward Tomasz Napierala 		removed++;
626ec125fbbSEdward Tomasz Napierala 	}
627ec125fbbSEdward Tomasz Napierala 	return (removed);
628ec125fbbSEdward Tomasz Napierala }
629ec125fbbSEdward Tomasz Napierala 
630ec125fbbSEdward Tomasz Napierala static void
631ec125fbbSEdward Tomasz Napierala rctl_rule_acquire_subject(struct rctl_rule *rule)
632ec125fbbSEdward Tomasz Napierala {
633ec125fbbSEdward Tomasz Napierala 
634ec125fbbSEdward Tomasz Napierala 	switch (rule->rr_subject_type) {
635ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_UNDEFINED:
636ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_PROCESS:
637a7ad07bfSEdward Tomasz Napierala 		break;
638ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_JAIL:
639a7ad07bfSEdward Tomasz Napierala 		if (rule->rr_subject.rs_prison_racct != NULL)
640a7ad07bfSEdward Tomasz Napierala 			prison_racct_hold(rule->rr_subject.rs_prison_racct);
641ec125fbbSEdward Tomasz Napierala 		break;
642ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_USER:
643ec125fbbSEdward Tomasz Napierala 		if (rule->rr_subject.rs_uip != NULL)
644ec125fbbSEdward Tomasz Napierala 			uihold(rule->rr_subject.rs_uip);
645ec125fbbSEdward Tomasz Napierala 		break;
646ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_LOGINCLASS:
647415896e3SEdward Tomasz Napierala 		if (rule->rr_subject.rs_loginclass != NULL)
648415896e3SEdward Tomasz Napierala 			loginclass_hold(rule->rr_subject.rs_loginclass);
649ec125fbbSEdward Tomasz Napierala 		break;
650ec125fbbSEdward Tomasz Napierala 	default:
651ec125fbbSEdward Tomasz Napierala 		panic("rctl_rule_acquire_subject: unknown subject type %d",
652ec125fbbSEdward Tomasz Napierala 		    rule->rr_subject_type);
653ec125fbbSEdward Tomasz Napierala 	}
654ec125fbbSEdward Tomasz Napierala }
655ec125fbbSEdward Tomasz Napierala 
656ec125fbbSEdward Tomasz Napierala static void
657ec125fbbSEdward Tomasz Napierala rctl_rule_release_subject(struct rctl_rule *rule)
658ec125fbbSEdward Tomasz Napierala {
659ec125fbbSEdward Tomasz Napierala 
660ec125fbbSEdward Tomasz Napierala 	switch (rule->rr_subject_type) {
661ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_UNDEFINED:
662ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_PROCESS:
663a7ad07bfSEdward Tomasz Napierala 		break;
664ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_JAIL:
665a7ad07bfSEdward Tomasz Napierala 		if (rule->rr_subject.rs_prison_racct != NULL)
666a7ad07bfSEdward Tomasz Napierala 			prison_racct_free(rule->rr_subject.rs_prison_racct);
667ec125fbbSEdward Tomasz Napierala 		break;
668ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_USER:
669ec125fbbSEdward Tomasz Napierala 		if (rule->rr_subject.rs_uip != NULL)
670ec125fbbSEdward Tomasz Napierala 			uifree(rule->rr_subject.rs_uip);
671ec125fbbSEdward Tomasz Napierala 		break;
672ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_LOGINCLASS:
673415896e3SEdward Tomasz Napierala 		if (rule->rr_subject.rs_loginclass != NULL)
674415896e3SEdward Tomasz Napierala 			loginclass_free(rule->rr_subject.rs_loginclass);
675ec125fbbSEdward Tomasz Napierala 		break;
676ec125fbbSEdward Tomasz Napierala 	default:
677ec125fbbSEdward Tomasz Napierala 		panic("rctl_rule_release_subject: unknown subject type %d",
678ec125fbbSEdward Tomasz Napierala 		    rule->rr_subject_type);
679ec125fbbSEdward Tomasz Napierala 	}
680ec125fbbSEdward Tomasz Napierala }
681ec125fbbSEdward Tomasz Napierala 
682ec125fbbSEdward Tomasz Napierala struct rctl_rule *
683ec125fbbSEdward Tomasz Napierala rctl_rule_alloc(int flags)
684ec125fbbSEdward Tomasz Napierala {
685ec125fbbSEdward Tomasz Napierala 	struct rctl_rule *rule;
686ec125fbbSEdward Tomasz Napierala 
687ec125fbbSEdward Tomasz Napierala 	rule = uma_zalloc(rctl_rule_zone, flags);
688ec125fbbSEdward Tomasz Napierala 	if (rule == NULL)
689ec125fbbSEdward Tomasz Napierala 		return (NULL);
690ec125fbbSEdward Tomasz Napierala 	rule->rr_subject_type = RCTL_SUBJECT_TYPE_UNDEFINED;
691ec125fbbSEdward Tomasz Napierala 	rule->rr_subject.rs_proc = NULL;
692ec125fbbSEdward Tomasz Napierala 	rule->rr_subject.rs_uip = NULL;
693415896e3SEdward Tomasz Napierala 	rule->rr_subject.rs_loginclass = NULL;
694a7ad07bfSEdward Tomasz Napierala 	rule->rr_subject.rs_prison_racct = NULL;
695ec125fbbSEdward Tomasz Napierala 	rule->rr_per = RCTL_SUBJECT_TYPE_UNDEFINED;
696ec125fbbSEdward Tomasz Napierala 	rule->rr_resource = RACCT_UNDEFINED;
697ec125fbbSEdward Tomasz Napierala 	rule->rr_action = RCTL_ACTION_UNDEFINED;
698ec125fbbSEdward Tomasz Napierala 	rule->rr_amount = RCTL_AMOUNT_UNDEFINED;
699ec125fbbSEdward Tomasz Napierala 	refcount_init(&rule->rr_refcount, 1);
700ec125fbbSEdward Tomasz Napierala 
701ec125fbbSEdward Tomasz Napierala 	return (rule);
702ec125fbbSEdward Tomasz Napierala }
703ec125fbbSEdward Tomasz Napierala 
704ec125fbbSEdward Tomasz Napierala struct rctl_rule *
705ec125fbbSEdward Tomasz Napierala rctl_rule_duplicate(const struct rctl_rule *rule, int flags)
706ec125fbbSEdward Tomasz Napierala {
707ec125fbbSEdward Tomasz Napierala 	struct rctl_rule *copy;
708ec125fbbSEdward Tomasz Napierala 
709ec125fbbSEdward Tomasz Napierala 	copy = uma_zalloc(rctl_rule_zone, flags);
710ec125fbbSEdward Tomasz Napierala 	if (copy == NULL)
711ec125fbbSEdward Tomasz Napierala 		return (NULL);
712ec125fbbSEdward Tomasz Napierala 	copy->rr_subject_type = rule->rr_subject_type;
713ec125fbbSEdward Tomasz Napierala 	copy->rr_subject.rs_proc = rule->rr_subject.rs_proc;
714ec125fbbSEdward Tomasz Napierala 	copy->rr_subject.rs_uip = rule->rr_subject.rs_uip;
715415896e3SEdward Tomasz Napierala 	copy->rr_subject.rs_loginclass = rule->rr_subject.rs_loginclass;
716a7ad07bfSEdward Tomasz Napierala 	copy->rr_subject.rs_prison_racct = rule->rr_subject.rs_prison_racct;
717ec125fbbSEdward Tomasz Napierala 	copy->rr_per = rule->rr_per;
718ec125fbbSEdward Tomasz Napierala 	copy->rr_resource = rule->rr_resource;
719ec125fbbSEdward Tomasz Napierala 	copy->rr_action = rule->rr_action;
720ec125fbbSEdward Tomasz Napierala 	copy->rr_amount = rule->rr_amount;
721ec125fbbSEdward Tomasz Napierala 	refcount_init(&copy->rr_refcount, 1);
722ec125fbbSEdward Tomasz Napierala 	rctl_rule_acquire_subject(copy);
723ec125fbbSEdward Tomasz Napierala 
724ec125fbbSEdward Tomasz Napierala 	return (copy);
725ec125fbbSEdward Tomasz Napierala }
726ec125fbbSEdward Tomasz Napierala 
727ec125fbbSEdward Tomasz Napierala void
728ec125fbbSEdward Tomasz Napierala rctl_rule_acquire(struct rctl_rule *rule)
729ec125fbbSEdward Tomasz Napierala {
730ec125fbbSEdward Tomasz Napierala 
731ec125fbbSEdward Tomasz Napierala 	KASSERT(rule->rr_refcount > 0, ("rule->rr_refcount <= 0"));
732ec125fbbSEdward Tomasz Napierala 
733ec125fbbSEdward Tomasz Napierala 	refcount_acquire(&rule->rr_refcount);
734ec125fbbSEdward Tomasz Napierala }
735ec125fbbSEdward Tomasz Napierala 
736ec125fbbSEdward Tomasz Napierala static void
737ec125fbbSEdward Tomasz Napierala rctl_rule_free(void *context, int pending)
738ec125fbbSEdward Tomasz Napierala {
739ec125fbbSEdward Tomasz Napierala 	struct rctl_rule *rule;
740ec125fbbSEdward Tomasz Napierala 
741ec125fbbSEdward Tomasz Napierala 	rule = (struct rctl_rule *)context;
742ec125fbbSEdward Tomasz Napierala 
743ec125fbbSEdward Tomasz Napierala 	KASSERT(rule->rr_refcount == 0, ("rule->rr_refcount != 0"));
744ec125fbbSEdward Tomasz Napierala 
745ec125fbbSEdward Tomasz Napierala 	/*
746ec125fbbSEdward Tomasz Napierala 	 * We don't need locking here; rule is guaranteed to be inaccessible.
747ec125fbbSEdward Tomasz Napierala 	 */
748ec125fbbSEdward Tomasz Napierala 
749ec125fbbSEdward Tomasz Napierala 	rctl_rule_release_subject(rule);
750ec125fbbSEdward Tomasz Napierala 	uma_zfree(rctl_rule_zone, rule);
751ec125fbbSEdward Tomasz Napierala }
752ec125fbbSEdward Tomasz Napierala 
753ec125fbbSEdward Tomasz Napierala void
754ec125fbbSEdward Tomasz Napierala rctl_rule_release(struct rctl_rule *rule)
755ec125fbbSEdward Tomasz Napierala {
756ec125fbbSEdward Tomasz Napierala 
757ec125fbbSEdward Tomasz Napierala 	KASSERT(rule->rr_refcount > 0, ("rule->rr_refcount <= 0"));
758ec125fbbSEdward Tomasz Napierala 
759ec125fbbSEdward Tomasz Napierala 	if (refcount_release(&rule->rr_refcount)) {
760ec125fbbSEdward Tomasz Napierala 		/*
761ec125fbbSEdward Tomasz Napierala 		 * rctl_rule_release() is often called when iterating
762ec125fbbSEdward Tomasz Napierala 		 * over all the uidinfo structures in the system,
763ec125fbbSEdward Tomasz Napierala 		 * holding uihashtbl_lock.  Since rctl_rule_free()
764ec125fbbSEdward Tomasz Napierala 		 * might end up calling uifree(), this would lead
765ec125fbbSEdward Tomasz Napierala 		 * to lock recursion.  Use taskqueue to avoid this.
766ec125fbbSEdward Tomasz Napierala 		 */
767ec125fbbSEdward Tomasz Napierala 		TASK_INIT(&rule->rr_task, 0, rctl_rule_free, rule);
768ec125fbbSEdward Tomasz Napierala 		taskqueue_enqueue(taskqueue_thread, &rule->rr_task);
769ec125fbbSEdward Tomasz Napierala 	}
770ec125fbbSEdward Tomasz Napierala }
771ec125fbbSEdward Tomasz Napierala 
772ec125fbbSEdward Tomasz Napierala static int
773ec125fbbSEdward Tomasz Napierala rctl_rule_fully_specified(const struct rctl_rule *rule)
774ec125fbbSEdward Tomasz Napierala {
775ec125fbbSEdward Tomasz Napierala 
776ec125fbbSEdward Tomasz Napierala 	switch (rule->rr_subject_type) {
777ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_UNDEFINED:
778ec125fbbSEdward Tomasz Napierala 		return (0);
779ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_PROCESS:
780ec125fbbSEdward Tomasz Napierala 		if (rule->rr_subject.rs_proc == NULL)
781ec125fbbSEdward Tomasz Napierala 			return (0);
782ec125fbbSEdward Tomasz Napierala 		break;
783ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_USER:
784ec125fbbSEdward Tomasz Napierala 		if (rule->rr_subject.rs_uip == NULL)
785ec125fbbSEdward Tomasz Napierala 			return (0);
786ec125fbbSEdward Tomasz Napierala 		break;
787ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_LOGINCLASS:
788415896e3SEdward Tomasz Napierala 		if (rule->rr_subject.rs_loginclass == NULL)
789ec125fbbSEdward Tomasz Napierala 			return (0);
790ec125fbbSEdward Tomasz Napierala 		break;
791ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_JAIL:
792a7ad07bfSEdward Tomasz Napierala 		if (rule->rr_subject.rs_prison_racct == NULL)
793ec125fbbSEdward Tomasz Napierala 			return (0);
794ec125fbbSEdward Tomasz Napierala 		break;
795ec125fbbSEdward Tomasz Napierala 	default:
796ec125fbbSEdward Tomasz Napierala 		panic("rctl_rule_fully_specified: unknown subject type %d",
797ec125fbbSEdward Tomasz Napierala 		    rule->rr_subject_type);
798ec125fbbSEdward Tomasz Napierala 	}
799ec125fbbSEdward Tomasz Napierala 	if (rule->rr_resource == RACCT_UNDEFINED)
800ec125fbbSEdward Tomasz Napierala 		return (0);
801ec125fbbSEdward Tomasz Napierala 	if (rule->rr_action == RCTL_ACTION_UNDEFINED)
802ec125fbbSEdward Tomasz Napierala 		return (0);
803ec125fbbSEdward Tomasz Napierala 	if (rule->rr_amount == RCTL_AMOUNT_UNDEFINED)
804ec125fbbSEdward Tomasz Napierala 		return (0);
805ec125fbbSEdward Tomasz Napierala 	if (rule->rr_per == RCTL_SUBJECT_TYPE_UNDEFINED)
806ec125fbbSEdward Tomasz Napierala 		return (0);
807ec125fbbSEdward Tomasz Napierala 
808ec125fbbSEdward Tomasz Napierala 	return (1);
809ec125fbbSEdward Tomasz Napierala }
810ec125fbbSEdward Tomasz Napierala 
811ec125fbbSEdward Tomasz Napierala static int
812ec125fbbSEdward Tomasz Napierala rctl_string_to_rule(char *rulestr, struct rctl_rule **rulep)
813ec125fbbSEdward Tomasz Napierala {
814ec125fbbSEdward Tomasz Napierala 	int error = 0;
815ec125fbbSEdward Tomasz Napierala 	char *subjectstr, *subject_idstr, *resourcestr, *actionstr,
816ec125fbbSEdward Tomasz Napierala 	     *amountstr, *perstr;
817ec125fbbSEdward Tomasz Napierala 	struct rctl_rule *rule;
818ec125fbbSEdward Tomasz Napierala 	id_t id;
819ec125fbbSEdward Tomasz Napierala 
820ec125fbbSEdward Tomasz Napierala 	rule = rctl_rule_alloc(M_WAITOK);
821ec125fbbSEdward Tomasz Napierala 
822ec125fbbSEdward Tomasz Napierala 	subjectstr = strsep(&rulestr, ":");
823ec125fbbSEdward Tomasz Napierala 	subject_idstr = strsep(&rulestr, ":");
824ec125fbbSEdward Tomasz Napierala 	resourcestr = strsep(&rulestr, ":");
825ec125fbbSEdward Tomasz Napierala 	actionstr = strsep(&rulestr, "=/");
826ec125fbbSEdward Tomasz Napierala 	amountstr = strsep(&rulestr, "/");
827ec125fbbSEdward Tomasz Napierala 	perstr = rulestr;
828ec125fbbSEdward Tomasz Napierala 
829ec125fbbSEdward Tomasz Napierala 	if (subjectstr == NULL || subjectstr[0] == '\0')
830ec125fbbSEdward Tomasz Napierala 		rule->rr_subject_type = RCTL_SUBJECT_TYPE_UNDEFINED;
831ec125fbbSEdward Tomasz Napierala 	else {
832ec125fbbSEdward Tomasz Napierala 		error = str2value(subjectstr, &rule->rr_subject_type, subjectnames);
833ec125fbbSEdward Tomasz Napierala 		if (error != 0)
834ec125fbbSEdward Tomasz Napierala 			goto out;
835ec125fbbSEdward Tomasz Napierala 	}
836ec125fbbSEdward Tomasz Napierala 
837ec125fbbSEdward Tomasz Napierala 	if (subject_idstr == NULL || subject_idstr[0] == '\0') {
838ec125fbbSEdward Tomasz Napierala 		rule->rr_subject.rs_proc = NULL;
839ec125fbbSEdward Tomasz Napierala 		rule->rr_subject.rs_uip = NULL;
840415896e3SEdward Tomasz Napierala 		rule->rr_subject.rs_loginclass = NULL;
841a7ad07bfSEdward Tomasz Napierala 		rule->rr_subject.rs_prison_racct = NULL;
842ec125fbbSEdward Tomasz Napierala 	} else {
843ec125fbbSEdward Tomasz Napierala 		switch (rule->rr_subject_type) {
844ec125fbbSEdward Tomasz Napierala 		case RCTL_SUBJECT_TYPE_UNDEFINED:
845ec125fbbSEdward Tomasz Napierala 			error = EINVAL;
846ec125fbbSEdward Tomasz Napierala 			goto out;
847ec125fbbSEdward Tomasz Napierala 		case RCTL_SUBJECT_TYPE_PROCESS:
848ec125fbbSEdward Tomasz Napierala 			error = str2id(subject_idstr, &id);
849ec125fbbSEdward Tomasz Napierala 			if (error != 0)
850ec125fbbSEdward Tomasz Napierala 				goto out;
851ec125fbbSEdward Tomasz Napierala 			sx_assert(&allproc_lock, SA_LOCKED);
852ec125fbbSEdward Tomasz Napierala 			rule->rr_subject.rs_proc = pfind(id);
853ec125fbbSEdward Tomasz Napierala 			if (rule->rr_subject.rs_proc == NULL) {
854ec125fbbSEdward Tomasz Napierala 				error = ESRCH;
855ec125fbbSEdward Tomasz Napierala 				goto out;
856ec125fbbSEdward Tomasz Napierala 			}
857ec125fbbSEdward Tomasz Napierala 			PROC_UNLOCK(rule->rr_subject.rs_proc);
858ec125fbbSEdward Tomasz Napierala 			break;
859ec125fbbSEdward Tomasz Napierala 		case RCTL_SUBJECT_TYPE_USER:
860ec125fbbSEdward Tomasz Napierala 			error = str2id(subject_idstr, &id);
861ec125fbbSEdward Tomasz Napierala 			if (error != 0)
862ec125fbbSEdward Tomasz Napierala 				goto out;
863ec125fbbSEdward Tomasz Napierala 			rule->rr_subject.rs_uip = uifind(id);
864ec125fbbSEdward Tomasz Napierala 			break;
865ec125fbbSEdward Tomasz Napierala 		case RCTL_SUBJECT_TYPE_LOGINCLASS:
866415896e3SEdward Tomasz Napierala 			rule->rr_subject.rs_loginclass =
867ec125fbbSEdward Tomasz Napierala 			    loginclass_find(subject_idstr);
868415896e3SEdward Tomasz Napierala 			if (rule->rr_subject.rs_loginclass == NULL) {
869ec125fbbSEdward Tomasz Napierala 				error = ENAMETOOLONG;
870ec125fbbSEdward Tomasz Napierala 				goto out;
871ec125fbbSEdward Tomasz Napierala 			}
872ec125fbbSEdward Tomasz Napierala 			break;
873ec125fbbSEdward Tomasz Napierala 		case RCTL_SUBJECT_TYPE_JAIL:
874a7ad07bfSEdward Tomasz Napierala 			rule->rr_subject.rs_prison_racct =
875a7ad07bfSEdward Tomasz Napierala 			    prison_racct_find(subject_idstr);
876a7ad07bfSEdward Tomasz Napierala 			if (rule->rr_subject.rs_prison_racct == NULL) {
877a7ad07bfSEdward Tomasz Napierala 				error = ENAMETOOLONG;
878ec125fbbSEdward Tomasz Napierala 				goto out;
879ec125fbbSEdward Tomasz Napierala 			}
880ec125fbbSEdward Tomasz Napierala 			break;
881ec125fbbSEdward Tomasz Napierala                default:
882ec125fbbSEdward Tomasz Napierala                        panic("rctl_string_to_rule: unknown subject type %d",
883ec125fbbSEdward Tomasz Napierala                            rule->rr_subject_type);
884ec125fbbSEdward Tomasz Napierala                }
885ec125fbbSEdward Tomasz Napierala 	}
886ec125fbbSEdward Tomasz Napierala 
887ec125fbbSEdward Tomasz Napierala 	if (resourcestr == NULL || resourcestr[0] == '\0')
888ec125fbbSEdward Tomasz Napierala 		rule->rr_resource = RACCT_UNDEFINED;
889ec125fbbSEdward Tomasz Napierala 	else {
890ec125fbbSEdward Tomasz Napierala 		error = str2value(resourcestr, &rule->rr_resource,
891ec125fbbSEdward Tomasz Napierala 		    resourcenames);
892ec125fbbSEdward Tomasz Napierala 		if (error != 0)
893ec125fbbSEdward Tomasz Napierala 			goto out;
894ec125fbbSEdward Tomasz Napierala 	}
895ec125fbbSEdward Tomasz Napierala 
896ec125fbbSEdward Tomasz Napierala 	if (actionstr == NULL || actionstr[0] == '\0')
897ec125fbbSEdward Tomasz Napierala 		rule->rr_action = RCTL_ACTION_UNDEFINED;
898ec125fbbSEdward Tomasz Napierala 	else {
899ec125fbbSEdward Tomasz Napierala 		error = str2value(actionstr, &rule->rr_action, actionnames);
900ec125fbbSEdward Tomasz Napierala 		if (error != 0)
901ec125fbbSEdward Tomasz Napierala 			goto out;
902ec125fbbSEdward Tomasz Napierala 	}
903ec125fbbSEdward Tomasz Napierala 
904ec125fbbSEdward Tomasz Napierala 	if (amountstr == NULL || amountstr[0] == '\0')
905ec125fbbSEdward Tomasz Napierala 		rule->rr_amount = RCTL_AMOUNT_UNDEFINED;
906ec125fbbSEdward Tomasz Napierala 	else {
907ec125fbbSEdward Tomasz Napierala 		error = str2int64(amountstr, &rule->rr_amount);
908ec125fbbSEdward Tomasz Napierala 		if (error != 0)
909ec125fbbSEdward Tomasz Napierala 			goto out;
910*4fe84775SEdward Tomasz Napierala 		if (RACCT_IS_IN_THOUSANDS(rule->rr_resource))
911ec125fbbSEdward Tomasz Napierala 			rule->rr_amount *= 1000;
912ec125fbbSEdward Tomasz Napierala 	}
913ec125fbbSEdward Tomasz Napierala 
914ec125fbbSEdward Tomasz Napierala 	if (perstr == NULL || perstr[0] == '\0')
915ec125fbbSEdward Tomasz Napierala 		rule->rr_per = RCTL_SUBJECT_TYPE_UNDEFINED;
916ec125fbbSEdward Tomasz Napierala 	else {
917ec125fbbSEdward Tomasz Napierala 		error = str2value(perstr, &rule->rr_per, subjectnames);
918ec125fbbSEdward Tomasz Napierala 		if (error != 0)
919ec125fbbSEdward Tomasz Napierala 			goto out;
920ec125fbbSEdward Tomasz Napierala 	}
921ec125fbbSEdward Tomasz Napierala 
922ec125fbbSEdward Tomasz Napierala out:
923ec125fbbSEdward Tomasz Napierala 	if (error == 0)
924ec125fbbSEdward Tomasz Napierala 		*rulep = rule;
925ec125fbbSEdward Tomasz Napierala 	else
926ec125fbbSEdward Tomasz Napierala 		rctl_rule_release(rule);
927ec125fbbSEdward Tomasz Napierala 
928ec125fbbSEdward Tomasz Napierala 	return (error);
929ec125fbbSEdward Tomasz Napierala }
930ec125fbbSEdward Tomasz Napierala 
931ec125fbbSEdward Tomasz Napierala /*
932ec125fbbSEdward Tomasz Napierala  * Link a rule with all the subjects it applies to.
933ec125fbbSEdward Tomasz Napierala  */
934ec125fbbSEdward Tomasz Napierala int
935ec125fbbSEdward Tomasz Napierala rctl_rule_add(struct rctl_rule *rule)
936ec125fbbSEdward Tomasz Napierala {
937ec125fbbSEdward Tomasz Napierala 	struct proc *p;
938ec125fbbSEdward Tomasz Napierala 	struct ucred *cred;
939ec125fbbSEdward Tomasz Napierala 	struct uidinfo *uip;
940ec125fbbSEdward Tomasz Napierala 	struct prison *pr;
941a7ad07bfSEdward Tomasz Napierala 	struct prison_racct *prr;
942ec125fbbSEdward Tomasz Napierala 	struct loginclass *lc;
943ec125fbbSEdward Tomasz Napierala 	struct rctl_rule *rule2;
944ec125fbbSEdward Tomasz Napierala 	int match;
945ec125fbbSEdward Tomasz Napierala 
946ec125fbbSEdward Tomasz Napierala 	KASSERT(rctl_rule_fully_specified(rule), ("rule not fully specified"));
947ec125fbbSEdward Tomasz Napierala 
948ec125fbbSEdward Tomasz Napierala 	/*
949ec125fbbSEdward Tomasz Napierala 	 * Some rules just don't make sense.  Note that the one below
950*4fe84775SEdward Tomasz Napierala 	 * cannot be rewritten using RACCT_IS_DENIABLE(); the RACCT_PCTCPU,
951ec125fbbSEdward Tomasz Napierala 	 * for example, is not deniable in the racct sense, but the
952ec125fbbSEdward Tomasz Napierala 	 * limit is enforced in a different way, so "deny" rules for %CPU
953ec125fbbSEdward Tomasz Napierala 	 * do make sense.
954ec125fbbSEdward Tomasz Napierala 	 */
955ec125fbbSEdward Tomasz Napierala 	if (rule->rr_action == RCTL_ACTION_DENY &&
956ec125fbbSEdward Tomasz Napierala 	    (rule->rr_resource == RACCT_CPU ||
957ec125fbbSEdward Tomasz Napierala 	    rule->rr_resource == RACCT_WALLCLOCK))
958ec125fbbSEdward Tomasz Napierala 		return (EOPNOTSUPP);
959ec125fbbSEdward Tomasz Napierala 
960ec125fbbSEdward Tomasz Napierala 	if (rule->rr_per == RCTL_SUBJECT_TYPE_PROCESS &&
961*4fe84775SEdward Tomasz Napierala 	    RACCT_IS_SLOPPY(rule->rr_resource))
962ec125fbbSEdward Tomasz Napierala 		return (EOPNOTSUPP);
963ec125fbbSEdward Tomasz Napierala 
964ec125fbbSEdward Tomasz Napierala 	/*
965ec125fbbSEdward Tomasz Napierala 	 * Make sure there are no duplicated rules.  Also, for the "deny"
966ec125fbbSEdward Tomasz Napierala 	 * rules, remove ones differing only by "amount".
967ec125fbbSEdward Tomasz Napierala 	 */
968ec125fbbSEdward Tomasz Napierala 	if (rule->rr_action == RCTL_ACTION_DENY) {
969ec125fbbSEdward Tomasz Napierala 		rule2 = rctl_rule_duplicate(rule, M_WAITOK);
970ec125fbbSEdward Tomasz Napierala 		rule2->rr_amount = RCTL_AMOUNT_UNDEFINED;
971ec125fbbSEdward Tomasz Napierala 		rctl_rule_remove(rule2);
972ec125fbbSEdward Tomasz Napierala 		rctl_rule_release(rule2);
973ec125fbbSEdward Tomasz Napierala 	} else
974ec125fbbSEdward Tomasz Napierala 		rctl_rule_remove(rule);
975ec125fbbSEdward Tomasz Napierala 
976ec125fbbSEdward Tomasz Napierala 	switch (rule->rr_subject_type) {
977ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_PROCESS:
978ec125fbbSEdward Tomasz Napierala 		p = rule->rr_subject.rs_proc;
979ec125fbbSEdward Tomasz Napierala 		KASSERT(p != NULL, ("rctl_rule_add: NULL proc"));
980ec125fbbSEdward Tomasz Napierala 		/*
981ec125fbbSEdward Tomasz Napierala 		 * No resource limits for system processes.
982ec125fbbSEdward Tomasz Napierala 		 */
983ec125fbbSEdward Tomasz Napierala 		if (p->p_flag & P_SYSTEM)
984ec125fbbSEdward Tomasz Napierala 			return (EPERM);
985ec125fbbSEdward Tomasz Napierala 
986ec125fbbSEdward Tomasz Napierala 		rctl_racct_add_rule(p->p_racct, rule);
987ec125fbbSEdward Tomasz Napierala 		/*
988ec125fbbSEdward Tomasz Napierala 		 * In case of per-process rule, we don't have anything more
989ec125fbbSEdward Tomasz Napierala 		 * to do.
990ec125fbbSEdward Tomasz Napierala 		 */
991ec125fbbSEdward Tomasz Napierala 		return (0);
992ec125fbbSEdward Tomasz Napierala 
993ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_USER:
994ec125fbbSEdward Tomasz Napierala 		uip = rule->rr_subject.rs_uip;
995ec125fbbSEdward Tomasz Napierala 		KASSERT(uip != NULL, ("rctl_rule_add: NULL uip"));
996ec125fbbSEdward Tomasz Napierala 		rctl_racct_add_rule(uip->ui_racct, rule);
997ec125fbbSEdward Tomasz Napierala 		break;
998ec125fbbSEdward Tomasz Napierala 
999ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_LOGINCLASS:
1000415896e3SEdward Tomasz Napierala 		lc = rule->rr_subject.rs_loginclass;
1001ec125fbbSEdward Tomasz Napierala 		KASSERT(lc != NULL, ("rctl_rule_add: NULL loginclass"));
1002ec125fbbSEdward Tomasz Napierala 		rctl_racct_add_rule(lc->lc_racct, rule);
1003ec125fbbSEdward Tomasz Napierala 		break;
1004ec125fbbSEdward Tomasz Napierala 
1005ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_JAIL:
1006a7ad07bfSEdward Tomasz Napierala 		prr = rule->rr_subject.rs_prison_racct;
1007a7ad07bfSEdward Tomasz Napierala 		KASSERT(prr != NULL, ("rctl_rule_add: NULL pr"));
1008a7ad07bfSEdward Tomasz Napierala 		rctl_racct_add_rule(prr->prr_racct, rule);
1009ec125fbbSEdward Tomasz Napierala 		break;
1010ec125fbbSEdward Tomasz Napierala 
1011ec125fbbSEdward Tomasz Napierala 	default:
1012ec125fbbSEdward Tomasz Napierala 		panic("rctl_rule_add: unknown subject type %d",
1013ec125fbbSEdward Tomasz Napierala 		    rule->rr_subject_type);
1014ec125fbbSEdward Tomasz Napierala 	}
1015ec125fbbSEdward Tomasz Napierala 
1016ec125fbbSEdward Tomasz Napierala 	/*
1017ec125fbbSEdward Tomasz Napierala 	 * Now go through all the processes and add the new rule to the ones
1018ec125fbbSEdward Tomasz Napierala 	 * it applies to.
1019ec125fbbSEdward Tomasz Napierala 	 */
1020ec125fbbSEdward Tomasz Napierala 	sx_assert(&allproc_lock, SA_LOCKED);
1021ec125fbbSEdward Tomasz Napierala 	FOREACH_PROC_IN_SYSTEM(p) {
1022ec125fbbSEdward Tomasz Napierala 		if (p->p_flag & P_SYSTEM)
1023ec125fbbSEdward Tomasz Napierala 			continue;
1024ec125fbbSEdward Tomasz Napierala 		cred = p->p_ucred;
1025ec125fbbSEdward Tomasz Napierala 		switch (rule->rr_subject_type) {
1026ec125fbbSEdward Tomasz Napierala 		case RCTL_SUBJECT_TYPE_USER:
1027ec125fbbSEdward Tomasz Napierala 			if (cred->cr_uidinfo == rule->rr_subject.rs_uip ||
1028ec125fbbSEdward Tomasz Napierala 			    cred->cr_ruidinfo == rule->rr_subject.rs_uip)
1029ec125fbbSEdward Tomasz Napierala 				break;
1030ec125fbbSEdward Tomasz Napierala 			continue;
1031ec125fbbSEdward Tomasz Napierala 		case RCTL_SUBJECT_TYPE_LOGINCLASS:
1032415896e3SEdward Tomasz Napierala 			if (cred->cr_loginclass == rule->rr_subject.rs_loginclass)
1033ec125fbbSEdward Tomasz Napierala 				break;
1034ec125fbbSEdward Tomasz Napierala 			continue;
1035ec125fbbSEdward Tomasz Napierala 		case RCTL_SUBJECT_TYPE_JAIL:
1036ec125fbbSEdward Tomasz Napierala 			match = 0;
1037ec125fbbSEdward Tomasz Napierala 			for (pr = cred->cr_prison; pr != NULL; pr = pr->pr_parent) {
1038a7ad07bfSEdward Tomasz Napierala 				if (pr->pr_prison_racct == rule->rr_subject.rs_prison_racct) {
1039ec125fbbSEdward Tomasz Napierala 					match = 1;
1040ec125fbbSEdward Tomasz Napierala 					break;
1041ec125fbbSEdward Tomasz Napierala 				}
1042ec125fbbSEdward Tomasz Napierala 			}
1043ec125fbbSEdward Tomasz Napierala 			if (match)
1044ec125fbbSEdward Tomasz Napierala 				break;
1045ec125fbbSEdward Tomasz Napierala 			continue;
1046ec125fbbSEdward Tomasz Napierala 		default:
1047ec125fbbSEdward Tomasz Napierala 			panic("rctl_rule_add: unknown subject type %d",
1048ec125fbbSEdward Tomasz Napierala 			    rule->rr_subject_type);
1049ec125fbbSEdward Tomasz Napierala 		}
1050ec125fbbSEdward Tomasz Napierala 
1051ec125fbbSEdward Tomasz Napierala 		rctl_racct_add_rule(p->p_racct, rule);
1052ec125fbbSEdward Tomasz Napierala 	}
1053ec125fbbSEdward Tomasz Napierala 
1054ec125fbbSEdward Tomasz Napierala 	return (0);
1055ec125fbbSEdward Tomasz Napierala }
1056ec125fbbSEdward Tomasz Napierala 
1057ec125fbbSEdward Tomasz Napierala static void
1058ec125fbbSEdward Tomasz Napierala rctl_rule_remove_callback(struct racct *racct, void *arg2, void *arg3)
1059ec125fbbSEdward Tomasz Napierala {
1060ec125fbbSEdward Tomasz Napierala 	struct rctl_rule *filter = (struct rctl_rule *)arg2;
1061ec125fbbSEdward Tomasz Napierala 	int found = 0;
1062ec125fbbSEdward Tomasz Napierala 
1063ec125fbbSEdward Tomasz Napierala 	rw_wlock(&rctl_lock);
1064ec125fbbSEdward Tomasz Napierala 	found += rctl_racct_remove_rules(racct, filter);
1065ec125fbbSEdward Tomasz Napierala 	rw_wunlock(&rctl_lock);
1066ec125fbbSEdward Tomasz Napierala 
1067ec125fbbSEdward Tomasz Napierala 	*((int *)arg3) += found;
1068ec125fbbSEdward Tomasz Napierala }
1069ec125fbbSEdward Tomasz Napierala 
1070ec125fbbSEdward Tomasz Napierala /*
1071ec125fbbSEdward Tomasz Napierala  * Remove all rules that match the filter.
1072ec125fbbSEdward Tomasz Napierala  */
1073ec125fbbSEdward Tomasz Napierala int
1074ec125fbbSEdward Tomasz Napierala rctl_rule_remove(struct rctl_rule *filter)
1075ec125fbbSEdward Tomasz Napierala {
1076ec125fbbSEdward Tomasz Napierala 	int found = 0;
1077ec125fbbSEdward Tomasz Napierala 	struct proc *p;
1078ec125fbbSEdward Tomasz Napierala 
1079ec125fbbSEdward Tomasz Napierala 	if (filter->rr_subject_type == RCTL_SUBJECT_TYPE_PROCESS &&
1080ec125fbbSEdward Tomasz Napierala 	    filter->rr_subject.rs_proc != NULL) {
1081ec125fbbSEdward Tomasz Napierala 		p = filter->rr_subject.rs_proc;
1082ec125fbbSEdward Tomasz Napierala 		rw_wlock(&rctl_lock);
1083ec125fbbSEdward Tomasz Napierala 		found = rctl_racct_remove_rules(p->p_racct, filter);
1084ec125fbbSEdward Tomasz Napierala 		rw_wunlock(&rctl_lock);
1085ec125fbbSEdward Tomasz Napierala 		if (found)
1086ec125fbbSEdward Tomasz Napierala 			return (0);
1087ec125fbbSEdward Tomasz Napierala 		return (ESRCH);
1088ec125fbbSEdward Tomasz Napierala 	}
1089ec125fbbSEdward Tomasz Napierala 
1090ec125fbbSEdward Tomasz Napierala 	loginclass_racct_foreach(rctl_rule_remove_callback, filter,
1091ec125fbbSEdward Tomasz Napierala 	    (void *)&found);
1092ec125fbbSEdward Tomasz Napierala 	ui_racct_foreach(rctl_rule_remove_callback, filter,
1093ec125fbbSEdward Tomasz Napierala 	    (void *)&found);
1094ec125fbbSEdward Tomasz Napierala 	prison_racct_foreach(rctl_rule_remove_callback, filter,
1095ec125fbbSEdward Tomasz Napierala 	    (void *)&found);
1096ec125fbbSEdward Tomasz Napierala 
1097ec125fbbSEdward Tomasz Napierala 	sx_assert(&allproc_lock, SA_LOCKED);
1098ec125fbbSEdward Tomasz Napierala 	rw_wlock(&rctl_lock);
1099ec125fbbSEdward Tomasz Napierala 	FOREACH_PROC_IN_SYSTEM(p) {
1100ec125fbbSEdward Tomasz Napierala 		found += rctl_racct_remove_rules(p->p_racct, filter);
1101ec125fbbSEdward Tomasz Napierala 	}
1102ec125fbbSEdward Tomasz Napierala 	rw_wunlock(&rctl_lock);
1103ec125fbbSEdward Tomasz Napierala 
1104ec125fbbSEdward Tomasz Napierala 	if (found)
1105ec125fbbSEdward Tomasz Napierala 		return (0);
1106ec125fbbSEdward Tomasz Napierala 	return (ESRCH);
1107ec125fbbSEdward Tomasz Napierala }
1108ec125fbbSEdward Tomasz Napierala 
1109ec125fbbSEdward Tomasz Napierala /*
1110ec125fbbSEdward Tomasz Napierala  * Appends a rule to the sbuf.
1111ec125fbbSEdward Tomasz Napierala  */
1112ec125fbbSEdward Tomasz Napierala static void
1113ec125fbbSEdward Tomasz Napierala rctl_rule_to_sbuf(struct sbuf *sb, const struct rctl_rule *rule)
1114ec125fbbSEdward Tomasz Napierala {
1115ec125fbbSEdward Tomasz Napierala 	int64_t amount;
1116ec125fbbSEdward Tomasz Napierala 
1117ec125fbbSEdward Tomasz Napierala 	sbuf_printf(sb, "%s:", rctl_subject_type_name(rule->rr_subject_type));
1118ec125fbbSEdward Tomasz Napierala 
1119ec125fbbSEdward Tomasz Napierala 	switch (rule->rr_subject_type) {
1120ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_PROCESS:
1121ec125fbbSEdward Tomasz Napierala 		if (rule->rr_subject.rs_proc == NULL)
1122ec125fbbSEdward Tomasz Napierala 			sbuf_printf(sb, ":");
1123ec125fbbSEdward Tomasz Napierala 		else
1124ec125fbbSEdward Tomasz Napierala 			sbuf_printf(sb, "%d:",
1125ec125fbbSEdward Tomasz Napierala 			    rule->rr_subject.rs_proc->p_pid);
1126ec125fbbSEdward Tomasz Napierala 		break;
1127ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_USER:
1128ec125fbbSEdward Tomasz Napierala 		if (rule->rr_subject.rs_uip == NULL)
1129ec125fbbSEdward Tomasz Napierala 			sbuf_printf(sb, ":");
1130ec125fbbSEdward Tomasz Napierala 		else
1131ec125fbbSEdward Tomasz Napierala 			sbuf_printf(sb, "%d:",
1132ec125fbbSEdward Tomasz Napierala 			    rule->rr_subject.rs_uip->ui_uid);
1133ec125fbbSEdward Tomasz Napierala 		break;
1134ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_LOGINCLASS:
1135415896e3SEdward Tomasz Napierala 		if (rule->rr_subject.rs_loginclass == NULL)
1136ec125fbbSEdward Tomasz Napierala 			sbuf_printf(sb, ":");
1137ec125fbbSEdward Tomasz Napierala 		else
1138ec125fbbSEdward Tomasz Napierala 			sbuf_printf(sb, "%s:",
1139415896e3SEdward Tomasz Napierala 			    rule->rr_subject.rs_loginclass->lc_name);
1140ec125fbbSEdward Tomasz Napierala 		break;
1141ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_JAIL:
1142a7ad07bfSEdward Tomasz Napierala 		if (rule->rr_subject.rs_prison_racct == NULL)
1143ec125fbbSEdward Tomasz Napierala 			sbuf_printf(sb, ":");
1144ec125fbbSEdward Tomasz Napierala 		else
1145ec125fbbSEdward Tomasz Napierala 			sbuf_printf(sb, "%s:",
1146a7ad07bfSEdward Tomasz Napierala 			    rule->rr_subject.rs_prison_racct->prr_name);
1147ec125fbbSEdward Tomasz Napierala 		break;
1148ec125fbbSEdward Tomasz Napierala 	default:
1149ec125fbbSEdward Tomasz Napierala 		panic("rctl_rule_to_sbuf: unknown subject type %d",
1150ec125fbbSEdward Tomasz Napierala 		    rule->rr_subject_type);
1151ec125fbbSEdward Tomasz Napierala 	}
1152ec125fbbSEdward Tomasz Napierala 
1153ec125fbbSEdward Tomasz Napierala 	amount = rule->rr_amount;
1154ec125fbbSEdward Tomasz Napierala 	if (amount != RCTL_AMOUNT_UNDEFINED &&
1155*4fe84775SEdward Tomasz Napierala 	    RACCT_IS_IN_THOUSANDS(rule->rr_resource))
1156ec125fbbSEdward Tomasz Napierala 		amount /= 1000;
1157ec125fbbSEdward Tomasz Napierala 
1158ec125fbbSEdward Tomasz Napierala 	sbuf_printf(sb, "%s:%s=%jd",
1159ec125fbbSEdward Tomasz Napierala 	    rctl_resource_name(rule->rr_resource),
1160ec125fbbSEdward Tomasz Napierala 	    rctl_action_name(rule->rr_action),
1161ec125fbbSEdward Tomasz Napierala 	    amount);
1162ec125fbbSEdward Tomasz Napierala 
1163ec125fbbSEdward Tomasz Napierala 	if (rule->rr_per != rule->rr_subject_type)
1164ec125fbbSEdward Tomasz Napierala 		sbuf_printf(sb, "/%s", rctl_subject_type_name(rule->rr_per));
1165ec125fbbSEdward Tomasz Napierala }
1166ec125fbbSEdward Tomasz Napierala 
1167ec125fbbSEdward Tomasz Napierala /*
1168ec125fbbSEdward Tomasz Napierala  * Routine used by RCTL syscalls to read in input string.
1169ec125fbbSEdward Tomasz Napierala  */
1170ec125fbbSEdward Tomasz Napierala static int
1171ec125fbbSEdward Tomasz Napierala rctl_read_inbuf(char **inputstr, const char *inbufp, size_t inbuflen)
1172ec125fbbSEdward Tomasz Napierala {
1173ec125fbbSEdward Tomasz Napierala 	int error;
1174ec125fbbSEdward Tomasz Napierala 	char *str;
1175ec125fbbSEdward Tomasz Napierala 
1176ec125fbbSEdward Tomasz Napierala 	if (inbuflen <= 0)
1177ec125fbbSEdward Tomasz Napierala 		return (EINVAL);
1178ec125fbbSEdward Tomasz Napierala 
1179ec125fbbSEdward Tomasz Napierala 	str = malloc(inbuflen + 1, M_RCTL, M_WAITOK);
1180ec125fbbSEdward Tomasz Napierala 	error = copyinstr(inbufp, str, inbuflen, NULL);
1181ec125fbbSEdward Tomasz Napierala 	if (error != 0) {
1182ec125fbbSEdward Tomasz Napierala 		free(str, M_RCTL);
1183ec125fbbSEdward Tomasz Napierala 		return (error);
1184ec125fbbSEdward Tomasz Napierala 	}
1185ec125fbbSEdward Tomasz Napierala 
1186ec125fbbSEdward Tomasz Napierala 	*inputstr = str;
1187ec125fbbSEdward Tomasz Napierala 
1188ec125fbbSEdward Tomasz Napierala 	return (0);
1189ec125fbbSEdward Tomasz Napierala }
1190ec125fbbSEdward Tomasz Napierala 
1191ec125fbbSEdward Tomasz Napierala /*
1192ec125fbbSEdward Tomasz Napierala  * Routine used by RCTL syscalls to write out output string.
1193ec125fbbSEdward Tomasz Napierala  */
1194ec125fbbSEdward Tomasz Napierala static int
1195ec125fbbSEdward Tomasz Napierala rctl_write_outbuf(struct sbuf *outputsbuf, char *outbufp, size_t outbuflen)
1196ec125fbbSEdward Tomasz Napierala {
1197ec125fbbSEdward Tomasz Napierala 	int error;
1198ec125fbbSEdward Tomasz Napierala 
1199ec125fbbSEdward Tomasz Napierala 	if (outputsbuf == NULL)
1200ec125fbbSEdward Tomasz Napierala 		return (0);
1201ec125fbbSEdward Tomasz Napierala 
1202ec125fbbSEdward Tomasz Napierala 	sbuf_finish(outputsbuf);
1203ec125fbbSEdward Tomasz Napierala 	if (outbuflen < sbuf_len(outputsbuf) + 1) {
1204ec125fbbSEdward Tomasz Napierala 		sbuf_delete(outputsbuf);
1205ec125fbbSEdward Tomasz Napierala 		return (ERANGE);
1206ec125fbbSEdward Tomasz Napierala 	}
1207ec125fbbSEdward Tomasz Napierala 	error = copyout(sbuf_data(outputsbuf), outbufp,
1208ec125fbbSEdward Tomasz Napierala 	    sbuf_len(outputsbuf) + 1);
1209ec125fbbSEdward Tomasz Napierala 	sbuf_delete(outputsbuf);
1210ec125fbbSEdward Tomasz Napierala 	return (error);
1211ec125fbbSEdward Tomasz Napierala }
1212ec125fbbSEdward Tomasz Napierala 
1213ec125fbbSEdward Tomasz Napierala static struct sbuf *
1214ec125fbbSEdward Tomasz Napierala rctl_racct_to_sbuf(struct racct *racct, int sloppy)
1215ec125fbbSEdward Tomasz Napierala {
1216ec125fbbSEdward Tomasz Napierala 	int i;
1217ec125fbbSEdward Tomasz Napierala 	int64_t amount;
1218ec125fbbSEdward Tomasz Napierala 	struct sbuf *sb;
1219ec125fbbSEdward Tomasz Napierala 
1220ec125fbbSEdward Tomasz Napierala 	sb = sbuf_new_auto();
1221ec125fbbSEdward Tomasz Napierala 	for (i = 0; i <= RACCT_MAX; i++) {
1222*4fe84775SEdward Tomasz Napierala 		if (sloppy == 0 && RACCT_IS_SLOPPY(i))
1223ec125fbbSEdward Tomasz Napierala 			continue;
1224ec125fbbSEdward Tomasz Napierala 		amount = racct->r_resources[i];
1225*4fe84775SEdward Tomasz Napierala 		if (RACCT_IS_IN_THOUSANDS(i))
1226ec125fbbSEdward Tomasz Napierala 			amount /= 1000;
1227ec125fbbSEdward Tomasz Napierala 		sbuf_printf(sb, "%s=%jd,", rctl_resource_name(i), amount);
1228ec125fbbSEdward Tomasz Napierala 	}
1229ec125fbbSEdward Tomasz Napierala 	sbuf_setpos(sb, sbuf_len(sb) - 1);
1230ec125fbbSEdward Tomasz Napierala 	return (sb);
1231ec125fbbSEdward Tomasz Napierala }
1232ec125fbbSEdward Tomasz Napierala 
1233ec125fbbSEdward Tomasz Napierala int
1234ec125fbbSEdward Tomasz Napierala rctl_get_racct(struct thread *td, struct rctl_get_racct_args *uap)
1235ec125fbbSEdward Tomasz Napierala {
1236ec125fbbSEdward Tomasz Napierala 	int error;
1237ec125fbbSEdward Tomasz Napierala 	char *inputstr;
1238ec125fbbSEdward Tomasz Napierala 	struct rctl_rule *filter;
1239ec125fbbSEdward Tomasz Napierala 	struct sbuf *outputsbuf = NULL;
1240ec125fbbSEdward Tomasz Napierala 	struct proc *p;
1241ec125fbbSEdward Tomasz Napierala 	struct uidinfo *uip;
1242ec125fbbSEdward Tomasz Napierala 	struct loginclass *lc;
1243a7ad07bfSEdward Tomasz Napierala 	struct prison_racct *prr;
1244ec125fbbSEdward Tomasz Napierala 
1245415896e3SEdward Tomasz Napierala 	error = priv_check(td, PRIV_RCTL_GET_RACCT);
1246ec125fbbSEdward Tomasz Napierala 	if (error != 0)
1247ec125fbbSEdward Tomasz Napierala 		return (error);
1248ec125fbbSEdward Tomasz Napierala 
1249ec125fbbSEdward Tomasz Napierala 	error = rctl_read_inbuf(&inputstr, uap->inbufp, uap->inbuflen);
1250ec125fbbSEdward Tomasz Napierala 	if (error != 0)
1251ec125fbbSEdward Tomasz Napierala 		return (error);
1252ec125fbbSEdward Tomasz Napierala 
1253ec125fbbSEdward Tomasz Napierala 	sx_slock(&allproc_lock);
1254ec125fbbSEdward Tomasz Napierala 	error = rctl_string_to_rule(inputstr, &filter);
1255ec125fbbSEdward Tomasz Napierala 	free(inputstr, M_RCTL);
1256ec125fbbSEdward Tomasz Napierala 	if (error != 0) {
1257ec125fbbSEdward Tomasz Napierala 		sx_sunlock(&allproc_lock);
1258ec125fbbSEdward Tomasz Napierala 		return (error);
1259ec125fbbSEdward Tomasz Napierala 	}
1260ec125fbbSEdward Tomasz Napierala 
1261ec125fbbSEdward Tomasz Napierala 	switch (filter->rr_subject_type) {
1262ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_PROCESS:
1263ec125fbbSEdward Tomasz Napierala 		p = filter->rr_subject.rs_proc;
1264ec125fbbSEdward Tomasz Napierala 		if (p == NULL) {
1265ec125fbbSEdward Tomasz Napierala 			error = EINVAL;
1266ec125fbbSEdward Tomasz Napierala 			goto out;
1267ec125fbbSEdward Tomasz Napierala 		}
1268ec125fbbSEdward Tomasz Napierala 		if (p->p_flag & P_SYSTEM) {
1269ec125fbbSEdward Tomasz Napierala 			error = EINVAL;
1270ec125fbbSEdward Tomasz Napierala 			goto out;
1271ec125fbbSEdward Tomasz Napierala 		}
1272ec125fbbSEdward Tomasz Napierala 		outputsbuf = rctl_racct_to_sbuf(p->p_racct, 0);
1273ec125fbbSEdward Tomasz Napierala 		break;
1274ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_USER:
1275ec125fbbSEdward Tomasz Napierala 		uip = filter->rr_subject.rs_uip;
1276ec125fbbSEdward Tomasz Napierala 		if (uip == NULL) {
1277ec125fbbSEdward Tomasz Napierala 			error = EINVAL;
1278ec125fbbSEdward Tomasz Napierala 			goto out;
1279ec125fbbSEdward Tomasz Napierala 		}
1280ec125fbbSEdward Tomasz Napierala 		outputsbuf = rctl_racct_to_sbuf(uip->ui_racct, 1);
1281ec125fbbSEdward Tomasz Napierala 		break;
1282ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_LOGINCLASS:
1283415896e3SEdward Tomasz Napierala 		lc = filter->rr_subject.rs_loginclass;
1284ec125fbbSEdward Tomasz Napierala 		if (lc == NULL) {
1285ec125fbbSEdward Tomasz Napierala 			error = EINVAL;
1286ec125fbbSEdward Tomasz Napierala 			goto out;
1287ec125fbbSEdward Tomasz Napierala 		}
1288ec125fbbSEdward Tomasz Napierala 		outputsbuf = rctl_racct_to_sbuf(lc->lc_racct, 1);
1289ec125fbbSEdward Tomasz Napierala 		break;
1290ec125fbbSEdward Tomasz Napierala 	case RCTL_SUBJECT_TYPE_JAIL:
1291a7ad07bfSEdward Tomasz Napierala 		prr = filter->rr_subject.rs_prison_racct;
1292a7ad07bfSEdward Tomasz Napierala 		if (prr == NULL) {
1293ec125fbbSEdward Tomasz Napierala 			error = EINVAL;
1294ec125fbbSEdward Tomasz Napierala 			goto out;
1295ec125fbbSEdward Tomasz Napierala 		}
1296a7ad07bfSEdward Tomasz Napierala 		outputsbuf = rctl_racct_to_sbuf(prr->prr_racct, 1);
1297ec125fbbSEdward Tomasz Napierala 		break;
1298ec125fbbSEdward Tomasz Napierala 	default:
1299ec125fbbSEdward Tomasz Napierala 		error = EINVAL;
1300ec125fbbSEdward Tomasz Napierala 	}
1301ec125fbbSEdward Tomasz Napierala out:
1302ec125fbbSEdward Tomasz Napierala 	rctl_rule_release(filter);
1303ec125fbbSEdward Tomasz Napierala 	sx_sunlock(&allproc_lock);
1304ec125fbbSEdward Tomasz Napierala 	if (error != 0)
1305ec125fbbSEdward Tomasz Napierala 		return (error);
1306ec125fbbSEdward Tomasz Napierala 
1307ec125fbbSEdward Tomasz Napierala 	error = rctl_write_outbuf(outputsbuf, uap->outbufp, uap->outbuflen);
1308ec125fbbSEdward Tomasz Napierala 
1309ec125fbbSEdward Tomasz Napierala 	return (error);
1310ec125fbbSEdward Tomasz Napierala }
1311ec125fbbSEdward Tomasz Napierala 
1312ec125fbbSEdward Tomasz Napierala static void
1313ec125fbbSEdward Tomasz Napierala rctl_get_rules_callback(struct racct *racct, void *arg2, void *arg3)
1314ec125fbbSEdward Tomasz Napierala {
1315ec125fbbSEdward Tomasz Napierala 	struct rctl_rule *filter = (struct rctl_rule *)arg2;
1316ec125fbbSEdward Tomasz Napierala 	struct rctl_rule_link *link;
1317ec125fbbSEdward Tomasz Napierala 	struct sbuf *sb = (struct sbuf *)arg3;
1318ec125fbbSEdward Tomasz Napierala 
1319ec125fbbSEdward Tomasz Napierala 	rw_rlock(&rctl_lock);
1320ec125fbbSEdward Tomasz Napierala 	LIST_FOREACH(link, &racct->r_rule_links, rrl_next) {
1321ec125fbbSEdward Tomasz Napierala 		if (!rctl_rule_matches(link->rrl_rule, filter))
1322ec125fbbSEdward Tomasz Napierala 			continue;
1323ec125fbbSEdward Tomasz Napierala 		rctl_rule_to_sbuf(sb, link->rrl_rule);
1324ec125fbbSEdward Tomasz Napierala 		sbuf_printf(sb, ",");
1325ec125fbbSEdward Tomasz Napierala 	}
1326ec125fbbSEdward Tomasz Napierala 	rw_runlock(&rctl_lock);
1327ec125fbbSEdward Tomasz Napierala }
1328ec125fbbSEdward Tomasz Napierala 
1329ec125fbbSEdward Tomasz Napierala int
1330ec125fbbSEdward Tomasz Napierala rctl_get_rules(struct thread *td, struct rctl_get_rules_args *uap)
1331ec125fbbSEdward Tomasz Napierala {
1332ec125fbbSEdward Tomasz Napierala 	int error;
1333ec125fbbSEdward Tomasz Napierala 	size_t bufsize = RCTL_DEFAULT_BUFSIZE;
1334ec125fbbSEdward Tomasz Napierala 	char *inputstr, *buf;
1335ec125fbbSEdward Tomasz Napierala 	struct sbuf *sb;
1336ec125fbbSEdward Tomasz Napierala 	struct rctl_rule *filter;
1337ec125fbbSEdward Tomasz Napierala 	struct rctl_rule_link *link;
1338ec125fbbSEdward Tomasz Napierala 	struct proc *p;
1339ec125fbbSEdward Tomasz Napierala 
1340ec125fbbSEdward Tomasz Napierala 	error = priv_check(td, PRIV_RCTL_GET_RULES);
1341ec125fbbSEdward Tomasz Napierala 	if (error != 0)
1342ec125fbbSEdward Tomasz Napierala 		return (error);
1343ec125fbbSEdward Tomasz Napierala 
1344ec125fbbSEdward Tomasz Napierala 	error = rctl_read_inbuf(&inputstr, uap->inbufp, uap->inbuflen);
1345ec125fbbSEdward Tomasz Napierala 	if (error != 0)
1346ec125fbbSEdward Tomasz Napierala 		return (error);
1347ec125fbbSEdward Tomasz Napierala 
1348ec125fbbSEdward Tomasz Napierala 	sx_slock(&allproc_lock);
1349ec125fbbSEdward Tomasz Napierala 	error = rctl_string_to_rule(inputstr, &filter);
1350ec125fbbSEdward Tomasz Napierala 	free(inputstr, M_RCTL);
1351ec125fbbSEdward Tomasz Napierala 	if (error != 0) {
1352ec125fbbSEdward Tomasz Napierala 		sx_sunlock(&allproc_lock);
1353ec125fbbSEdward Tomasz Napierala 		return (error);
1354ec125fbbSEdward Tomasz Napierala 	}
1355ec125fbbSEdward Tomasz Napierala 
1356ec125fbbSEdward Tomasz Napierala again:
1357ec125fbbSEdward Tomasz Napierala 	buf = malloc(bufsize, M_RCTL, M_WAITOK);
1358ec125fbbSEdward Tomasz Napierala 	sb = sbuf_new(NULL, buf, bufsize, SBUF_FIXEDLEN);
1359ec125fbbSEdward Tomasz Napierala 	KASSERT(sb != NULL, ("sbuf_new failed"));
1360ec125fbbSEdward Tomasz Napierala 
1361ec125fbbSEdward Tomasz Napierala 	sx_assert(&allproc_lock, SA_LOCKED);
1362ec125fbbSEdward Tomasz Napierala 	FOREACH_PROC_IN_SYSTEM(p) {
1363ec125fbbSEdward Tomasz Napierala 		rw_rlock(&rctl_lock);
1364ec125fbbSEdward Tomasz Napierala 		LIST_FOREACH(link, &p->p_racct->r_rule_links, rrl_next) {
1365ec125fbbSEdward Tomasz Napierala 			/*
1366ec125fbbSEdward Tomasz Napierala 			 * Non-process rules will be added to the buffer later.
1367ec125fbbSEdward Tomasz Napierala 			 * Adding them here would result in duplicated output.
1368ec125fbbSEdward Tomasz Napierala 			 */
1369ec125fbbSEdward Tomasz Napierala 			if (link->rrl_rule->rr_subject_type !=
1370ec125fbbSEdward Tomasz Napierala 			    RCTL_SUBJECT_TYPE_PROCESS)
1371ec125fbbSEdward Tomasz Napierala 				continue;
1372ec125fbbSEdward Tomasz Napierala 			if (!rctl_rule_matches(link->rrl_rule, filter))
1373ec125fbbSEdward Tomasz Napierala 				continue;
1374ec125fbbSEdward Tomasz Napierala 			rctl_rule_to_sbuf(sb, link->rrl_rule);
1375ec125fbbSEdward Tomasz Napierala 			sbuf_printf(sb, ",");
1376ec125fbbSEdward Tomasz Napierala 		}
1377ec125fbbSEdward Tomasz Napierala 		rw_runlock(&rctl_lock);
1378ec125fbbSEdward Tomasz Napierala 	}
1379ec125fbbSEdward Tomasz Napierala 
1380ec125fbbSEdward Tomasz Napierala 	loginclass_racct_foreach(rctl_get_rules_callback, filter, sb);
1381ec125fbbSEdward Tomasz Napierala 	ui_racct_foreach(rctl_get_rules_callback, filter, sb);
1382ec125fbbSEdward Tomasz Napierala 	prison_racct_foreach(rctl_get_rules_callback, filter, sb);
1383ec125fbbSEdward Tomasz Napierala 	if (sbuf_error(sb) == ENOMEM) {
1384ec125fbbSEdward Tomasz Napierala 		sbuf_delete(sb);
1385ec125fbbSEdward Tomasz Napierala 		free(buf, M_RCTL);
1386ec125fbbSEdward Tomasz Napierala 		bufsize *= 4;
1387ec125fbbSEdward Tomasz Napierala 		goto again;
1388ec125fbbSEdward Tomasz Napierala 	}
1389ec125fbbSEdward Tomasz Napierala 
1390ec125fbbSEdward Tomasz Napierala 	/*
1391ec125fbbSEdward Tomasz Napierala 	 * Remove trailing ",".
1392ec125fbbSEdward Tomasz Napierala 	 */
1393ec125fbbSEdward Tomasz Napierala 	if (sbuf_len(sb) > 0)
1394ec125fbbSEdward Tomasz Napierala 		sbuf_setpos(sb, sbuf_len(sb) - 1);
1395ec125fbbSEdward Tomasz Napierala 
1396ec125fbbSEdward Tomasz Napierala 	error = rctl_write_outbuf(sb, uap->outbufp, uap->outbuflen);
1397ec125fbbSEdward Tomasz Napierala 
1398ec125fbbSEdward Tomasz Napierala 	rctl_rule_release(filter);
1399ec125fbbSEdward Tomasz Napierala 	sx_sunlock(&allproc_lock);
1400ec125fbbSEdward Tomasz Napierala 	free(buf, M_RCTL);
1401ec125fbbSEdward Tomasz Napierala 	return (error);
1402ec125fbbSEdward Tomasz Napierala }
1403ec125fbbSEdward Tomasz Napierala 
1404ec125fbbSEdward Tomasz Napierala int
1405ec125fbbSEdward Tomasz Napierala rctl_get_limits(struct thread *td, struct rctl_get_limits_args *uap)
1406ec125fbbSEdward Tomasz Napierala {
1407ec125fbbSEdward Tomasz Napierala 	int error;
1408ec125fbbSEdward Tomasz Napierala 	size_t bufsize = RCTL_DEFAULT_BUFSIZE;
1409ec125fbbSEdward Tomasz Napierala 	char *inputstr, *buf;
1410ec125fbbSEdward Tomasz Napierala 	struct sbuf *sb;
1411ec125fbbSEdward Tomasz Napierala 	struct rctl_rule *filter;
1412ec125fbbSEdward Tomasz Napierala 	struct rctl_rule_link *link;
1413ec125fbbSEdward Tomasz Napierala 
1414ec125fbbSEdward Tomasz Napierala 	error = priv_check(td, PRIV_RCTL_GET_LIMITS);
1415ec125fbbSEdward Tomasz Napierala 	if (error != 0)
1416ec125fbbSEdward Tomasz Napierala 		return (error);
1417ec125fbbSEdward Tomasz Napierala 
1418ec125fbbSEdward Tomasz Napierala 	error = rctl_read_inbuf(&inputstr, uap->inbufp, uap->inbuflen);
1419ec125fbbSEdward Tomasz Napierala 	if (error != 0)
1420ec125fbbSEdward Tomasz Napierala 		return (error);
1421ec125fbbSEdward Tomasz Napierala 
1422ec125fbbSEdward Tomasz Napierala 	sx_slock(&allproc_lock);
1423ec125fbbSEdward Tomasz Napierala 	error = rctl_string_to_rule(inputstr, &filter);
1424ec125fbbSEdward Tomasz Napierala 	free(inputstr, M_RCTL);
1425ec125fbbSEdward Tomasz Napierala 	if (error != 0) {
1426ec125fbbSEdward Tomasz Napierala 		sx_sunlock(&allproc_lock);
1427ec125fbbSEdward Tomasz Napierala 		return (error);
1428ec125fbbSEdward Tomasz Napierala 	}
1429ec125fbbSEdward Tomasz Napierala 
1430ec125fbbSEdward Tomasz Napierala 	if (filter->rr_subject_type == RCTL_SUBJECT_TYPE_UNDEFINED) {
1431ec125fbbSEdward Tomasz Napierala 		rctl_rule_release(filter);
1432ec125fbbSEdward Tomasz Napierala 		sx_sunlock(&allproc_lock);
1433ec125fbbSEdward Tomasz Napierala 		return (EINVAL);
1434ec125fbbSEdward Tomasz Napierala 	}
1435ec125fbbSEdward Tomasz Napierala 	if (filter->rr_subject_type != RCTL_SUBJECT_TYPE_PROCESS) {
1436ec125fbbSEdward Tomasz Napierala 		rctl_rule_release(filter);
1437ec125fbbSEdward Tomasz Napierala 		sx_sunlock(&allproc_lock);
1438ec125fbbSEdward Tomasz Napierala 		return (EOPNOTSUPP);
1439ec125fbbSEdward Tomasz Napierala 	}
1440ec125fbbSEdward Tomasz Napierala 	if (filter->rr_subject.rs_proc == NULL) {
1441ec125fbbSEdward Tomasz Napierala 		rctl_rule_release(filter);
1442ec125fbbSEdward Tomasz Napierala 		sx_sunlock(&allproc_lock);
1443ec125fbbSEdward Tomasz Napierala 		return (EINVAL);
1444ec125fbbSEdward Tomasz Napierala 	}
1445ec125fbbSEdward Tomasz Napierala 
1446ec125fbbSEdward Tomasz Napierala again:
1447ec125fbbSEdward Tomasz Napierala 	buf = malloc(bufsize, M_RCTL, M_WAITOK);
1448ec125fbbSEdward Tomasz Napierala 	sb = sbuf_new(NULL, buf, bufsize, SBUF_FIXEDLEN);
1449ec125fbbSEdward Tomasz Napierala 	KASSERT(sb != NULL, ("sbuf_new failed"));
1450ec125fbbSEdward Tomasz Napierala 
1451ec125fbbSEdward Tomasz Napierala 	rw_rlock(&rctl_lock);
1452ec125fbbSEdward Tomasz Napierala 	LIST_FOREACH(link, &filter->rr_subject.rs_proc->p_racct->r_rule_links,
1453ec125fbbSEdward Tomasz Napierala 	    rrl_next) {
1454ec125fbbSEdward Tomasz Napierala 		rctl_rule_to_sbuf(sb, link->rrl_rule);
1455ec125fbbSEdward Tomasz Napierala 		sbuf_printf(sb, ",");
1456ec125fbbSEdward Tomasz Napierala 	}
1457ec125fbbSEdward Tomasz Napierala 	rw_runlock(&rctl_lock);
1458ec125fbbSEdward Tomasz Napierala 	if (sbuf_error(sb) == ENOMEM) {
1459ec125fbbSEdward Tomasz Napierala 		sbuf_delete(sb);
1460ec125fbbSEdward Tomasz Napierala 		free(buf, M_RCTL);
1461ec125fbbSEdward Tomasz Napierala 		bufsize *= 4;
1462ec125fbbSEdward Tomasz Napierala 		goto again;
1463ec125fbbSEdward Tomasz Napierala 	}
1464ec125fbbSEdward Tomasz Napierala 
1465ec125fbbSEdward Tomasz Napierala 	/*
1466ec125fbbSEdward Tomasz Napierala 	 * Remove trailing ",".
1467ec125fbbSEdward Tomasz Napierala 	 */
1468ec125fbbSEdward Tomasz Napierala 	if (sbuf_len(sb) > 0)
1469ec125fbbSEdward Tomasz Napierala 		sbuf_setpos(sb, sbuf_len(sb) - 1);
1470ec125fbbSEdward Tomasz Napierala 
1471ec125fbbSEdward Tomasz Napierala 	error = rctl_write_outbuf(sb, uap->outbufp, uap->outbuflen);
1472ec125fbbSEdward Tomasz Napierala 	rctl_rule_release(filter);
1473ec125fbbSEdward Tomasz Napierala 	sx_sunlock(&allproc_lock);
1474ec125fbbSEdward Tomasz Napierala 	free(buf, M_RCTL);
1475ec125fbbSEdward Tomasz Napierala 	return (error);
1476ec125fbbSEdward Tomasz Napierala }
1477ec125fbbSEdward Tomasz Napierala 
1478ec125fbbSEdward Tomasz Napierala int
1479ec125fbbSEdward Tomasz Napierala rctl_add_rule(struct thread *td, struct rctl_add_rule_args *uap)
1480ec125fbbSEdward Tomasz Napierala {
1481ec125fbbSEdward Tomasz Napierala 	int error;
1482ec125fbbSEdward Tomasz Napierala 	struct rctl_rule *rule;
1483ec125fbbSEdward Tomasz Napierala 	char *inputstr;
1484ec125fbbSEdward Tomasz Napierala 
1485ec125fbbSEdward Tomasz Napierala 	error = priv_check(td, PRIV_RCTL_ADD_RULE);
1486ec125fbbSEdward Tomasz Napierala 	if (error != 0)
1487ec125fbbSEdward Tomasz Napierala 		return (error);
1488ec125fbbSEdward Tomasz Napierala 
1489ec125fbbSEdward Tomasz Napierala 	error = rctl_read_inbuf(&inputstr, uap->inbufp, uap->inbuflen);
1490ec125fbbSEdward Tomasz Napierala 	if (error != 0)
1491ec125fbbSEdward Tomasz Napierala 		return (error);
1492ec125fbbSEdward Tomasz Napierala 
1493ec125fbbSEdward Tomasz Napierala 	sx_slock(&allproc_lock);
1494ec125fbbSEdward Tomasz Napierala 	error = rctl_string_to_rule(inputstr, &rule);
1495ec125fbbSEdward Tomasz Napierala 	free(inputstr, M_RCTL);
1496ec125fbbSEdward Tomasz Napierala 	if (error != 0) {
1497ec125fbbSEdward Tomasz Napierala 		sx_sunlock(&allproc_lock);
1498ec125fbbSEdward Tomasz Napierala 		return (error);
1499ec125fbbSEdward Tomasz Napierala 	}
1500ec125fbbSEdward Tomasz Napierala 	/*
1501ec125fbbSEdward Tomasz Napierala 	 * The 'per' part of a rule is optional.
1502ec125fbbSEdward Tomasz Napierala 	 */
1503ec125fbbSEdward Tomasz Napierala 	if (rule->rr_per == RCTL_SUBJECT_TYPE_UNDEFINED &&
1504ec125fbbSEdward Tomasz Napierala 	    rule->rr_subject_type != RCTL_SUBJECT_TYPE_UNDEFINED)
1505ec125fbbSEdward Tomasz Napierala 		rule->rr_per = rule->rr_subject_type;
1506ec125fbbSEdward Tomasz Napierala 
1507ec125fbbSEdward Tomasz Napierala 	if (!rctl_rule_fully_specified(rule)) {
1508ec125fbbSEdward Tomasz Napierala 		error = EINVAL;
1509ec125fbbSEdward Tomasz Napierala 		goto out;
1510ec125fbbSEdward Tomasz Napierala 	}
1511ec125fbbSEdward Tomasz Napierala 
1512ec125fbbSEdward Tomasz Napierala 	error = rctl_rule_add(rule);
1513ec125fbbSEdward Tomasz Napierala 
1514ec125fbbSEdward Tomasz Napierala out:
1515ec125fbbSEdward Tomasz Napierala 	rctl_rule_release(rule);
1516ec125fbbSEdward Tomasz Napierala 	sx_sunlock(&allproc_lock);
1517ec125fbbSEdward Tomasz Napierala 	return (error);
1518ec125fbbSEdward Tomasz Napierala }
1519ec125fbbSEdward Tomasz Napierala 
1520ec125fbbSEdward Tomasz Napierala int
1521ec125fbbSEdward Tomasz Napierala rctl_remove_rule(struct thread *td, struct rctl_remove_rule_args *uap)
1522ec125fbbSEdward Tomasz Napierala {
1523ec125fbbSEdward Tomasz Napierala 	int error;
1524ec125fbbSEdward Tomasz Napierala 	struct rctl_rule *filter;
1525ec125fbbSEdward Tomasz Napierala 	char *inputstr;
1526ec125fbbSEdward Tomasz Napierala 
1527ec125fbbSEdward Tomasz Napierala 	error = priv_check(td, PRIV_RCTL_REMOVE_RULE);
1528ec125fbbSEdward Tomasz Napierala 	if (error != 0)
1529ec125fbbSEdward Tomasz Napierala 		return (error);
1530ec125fbbSEdward Tomasz Napierala 
1531ec125fbbSEdward Tomasz Napierala 	error = rctl_read_inbuf(&inputstr, uap->inbufp, uap->inbuflen);
1532ec125fbbSEdward Tomasz Napierala 	if (error != 0)
1533ec125fbbSEdward Tomasz Napierala 		return (error);
1534ec125fbbSEdward Tomasz Napierala 
1535ec125fbbSEdward Tomasz Napierala 	sx_slock(&allproc_lock);
1536ec125fbbSEdward Tomasz Napierala 	error = rctl_string_to_rule(inputstr, &filter);
1537ec125fbbSEdward Tomasz Napierala 	free(inputstr, M_RCTL);
1538ec125fbbSEdward Tomasz Napierala 	if (error != 0) {
1539ec125fbbSEdward Tomasz Napierala 		sx_sunlock(&allproc_lock);
1540ec125fbbSEdward Tomasz Napierala 		return (error);
1541ec125fbbSEdward Tomasz Napierala 	}
1542ec125fbbSEdward Tomasz Napierala 
1543ec125fbbSEdward Tomasz Napierala 	error = rctl_rule_remove(filter);
1544ec125fbbSEdward Tomasz Napierala 	rctl_rule_release(filter);
1545ec125fbbSEdward Tomasz Napierala 	sx_sunlock(&allproc_lock);
1546ec125fbbSEdward Tomasz Napierala 
1547ec125fbbSEdward Tomasz Napierala 	return (error);
1548ec125fbbSEdward Tomasz Napierala }
1549ec125fbbSEdward Tomasz Napierala 
1550ec125fbbSEdward Tomasz Napierala /*
1551ec125fbbSEdward Tomasz Napierala  * Update RCTL rule list after credential change.
1552ec125fbbSEdward Tomasz Napierala  */
1553ec125fbbSEdward Tomasz Napierala void
1554ec125fbbSEdward Tomasz Napierala rctl_proc_ucred_changed(struct proc *p, struct ucred *newcred)
1555ec125fbbSEdward Tomasz Napierala {
1556ec125fbbSEdward Tomasz Napierala 	int rulecnt, i;
1557ec125fbbSEdward Tomasz Napierala 	struct rctl_rule_link *link, *newlink;
1558ec125fbbSEdward Tomasz Napierala 	struct uidinfo *newuip;
1559ec125fbbSEdward Tomasz Napierala 	struct loginclass *newlc;
1560a7ad07bfSEdward Tomasz Napierala 	struct prison_racct *newprr;
1561ec125fbbSEdward Tomasz Napierala 	LIST_HEAD(, rctl_rule_link) newrules;
1562ec125fbbSEdward Tomasz Napierala 
1563ec125fbbSEdward Tomasz Napierala 	newuip = newcred->cr_ruidinfo;
1564ec125fbbSEdward Tomasz Napierala 	newlc = newcred->cr_loginclass;
1565a7ad07bfSEdward Tomasz Napierala 	newprr = newcred->cr_prison->pr_prison_racct;
1566ec125fbbSEdward Tomasz Napierala 
1567ec125fbbSEdward Tomasz Napierala 	LIST_INIT(&newrules);
1568ec125fbbSEdward Tomasz Napierala 
1569ec125fbbSEdward Tomasz Napierala again:
1570ec125fbbSEdward Tomasz Napierala 	/*
1571ec125fbbSEdward Tomasz Napierala 	 * First, count the rules that apply to the process with new
1572ec125fbbSEdward Tomasz Napierala 	 * credentials.
1573ec125fbbSEdward Tomasz Napierala 	 */
1574ec125fbbSEdward Tomasz Napierala 	rulecnt = 0;
1575ec125fbbSEdward Tomasz Napierala 	rw_rlock(&rctl_lock);
1576ec125fbbSEdward Tomasz Napierala 	LIST_FOREACH(link, &p->p_racct->r_rule_links, rrl_next) {
1577ec125fbbSEdward Tomasz Napierala 		if (link->rrl_rule->rr_subject_type ==
1578ec125fbbSEdward Tomasz Napierala 		    RCTL_SUBJECT_TYPE_PROCESS)
1579ec125fbbSEdward Tomasz Napierala 			rulecnt++;
1580ec125fbbSEdward Tomasz Napierala 	}
1581ec125fbbSEdward Tomasz Napierala 	LIST_FOREACH(link, &newuip->ui_racct->r_rule_links, rrl_next)
1582ec125fbbSEdward Tomasz Napierala 		rulecnt++;
1583ec125fbbSEdward Tomasz Napierala 	LIST_FOREACH(link, &newlc->lc_racct->r_rule_links, rrl_next)
1584ec125fbbSEdward Tomasz Napierala 		rulecnt++;
1585a7ad07bfSEdward Tomasz Napierala 	LIST_FOREACH(link, &newprr->prr_racct->r_rule_links, rrl_next)
1586ec125fbbSEdward Tomasz Napierala 		rulecnt++;
1587ec125fbbSEdward Tomasz Napierala 	rw_runlock(&rctl_lock);
1588ec125fbbSEdward Tomasz Napierala 
1589ec125fbbSEdward Tomasz Napierala 	/*
1590ec125fbbSEdward Tomasz Napierala 	 * Create temporary list.  We've dropped the rctl_lock in order
1591ec125fbbSEdward Tomasz Napierala 	 * to use M_WAITOK.
1592ec125fbbSEdward Tomasz Napierala 	 */
1593ec125fbbSEdward Tomasz Napierala 	for (i = 0; i < rulecnt; i++) {
1594ec125fbbSEdward Tomasz Napierala 		newlink = uma_zalloc(rctl_rule_link_zone, M_WAITOK);
1595ec125fbbSEdward Tomasz Napierala 		newlink->rrl_rule = NULL;
1596ec125fbbSEdward Tomasz Napierala 		LIST_INSERT_HEAD(&newrules, newlink, rrl_next);
1597ec125fbbSEdward Tomasz Napierala 	}
1598ec125fbbSEdward Tomasz Napierala 
1599ec125fbbSEdward Tomasz Napierala 	newlink = LIST_FIRST(&newrules);
1600ec125fbbSEdward Tomasz Napierala 
1601ec125fbbSEdward Tomasz Napierala 	/*
1602ec125fbbSEdward Tomasz Napierala 	 * Assign rules to the newly allocated list entries.
1603ec125fbbSEdward Tomasz Napierala 	 */
1604ec125fbbSEdward Tomasz Napierala 	rw_wlock(&rctl_lock);
1605ec125fbbSEdward Tomasz Napierala 	LIST_FOREACH(link, &p->p_racct->r_rule_links, rrl_next) {
1606ec125fbbSEdward Tomasz Napierala 		if (link->rrl_rule->rr_subject_type ==
1607ec125fbbSEdward Tomasz Napierala 		    RCTL_SUBJECT_TYPE_PROCESS) {
1608ec125fbbSEdward Tomasz Napierala 			if (newlink == NULL)
1609ec125fbbSEdward Tomasz Napierala 				goto goaround;
1610ec125fbbSEdward Tomasz Napierala 			rctl_rule_acquire(link->rrl_rule);
1611ec125fbbSEdward Tomasz Napierala 			newlink->rrl_rule = link->rrl_rule;
1612ec125fbbSEdward Tomasz Napierala 			newlink = LIST_NEXT(newlink, rrl_next);
1613ec125fbbSEdward Tomasz Napierala 			rulecnt--;
1614ec125fbbSEdward Tomasz Napierala 		}
1615ec125fbbSEdward Tomasz Napierala 	}
1616ec125fbbSEdward Tomasz Napierala 
1617ec125fbbSEdward Tomasz Napierala 	LIST_FOREACH(link, &newuip->ui_racct->r_rule_links, rrl_next) {
1618ec125fbbSEdward Tomasz Napierala 		if (newlink == NULL)
1619ec125fbbSEdward Tomasz Napierala 			goto goaround;
1620ec125fbbSEdward Tomasz Napierala 		rctl_rule_acquire(link->rrl_rule);
1621ec125fbbSEdward Tomasz Napierala 		newlink->rrl_rule = link->rrl_rule;
1622ec125fbbSEdward Tomasz Napierala 		newlink = LIST_NEXT(newlink, rrl_next);
1623ec125fbbSEdward Tomasz Napierala 		rulecnt--;
1624ec125fbbSEdward Tomasz Napierala 	}
1625ec125fbbSEdward Tomasz Napierala 
1626ec125fbbSEdward Tomasz Napierala 	LIST_FOREACH(link, &newlc->lc_racct->r_rule_links, rrl_next) {
1627ec125fbbSEdward Tomasz Napierala 		if (newlink == NULL)
1628ec125fbbSEdward Tomasz Napierala 			goto goaround;
1629ec125fbbSEdward Tomasz Napierala 		rctl_rule_acquire(link->rrl_rule);
1630ec125fbbSEdward Tomasz Napierala 		newlink->rrl_rule = link->rrl_rule;
1631ec125fbbSEdward Tomasz Napierala 		newlink = LIST_NEXT(newlink, rrl_next);
1632ec125fbbSEdward Tomasz Napierala 		rulecnt--;
1633ec125fbbSEdward Tomasz Napierala 	}
1634ec125fbbSEdward Tomasz Napierala 
1635a7ad07bfSEdward Tomasz Napierala 	LIST_FOREACH(link, &newprr->prr_racct->r_rule_links, rrl_next) {
1636ec125fbbSEdward Tomasz Napierala 		if (newlink == NULL)
1637ec125fbbSEdward Tomasz Napierala 			goto goaround;
1638ec125fbbSEdward Tomasz Napierala 		rctl_rule_acquire(link->rrl_rule);
1639ec125fbbSEdward Tomasz Napierala 		newlink->rrl_rule = link->rrl_rule;
1640ec125fbbSEdward Tomasz Napierala 		newlink = LIST_NEXT(newlink, rrl_next);
1641ec125fbbSEdward Tomasz Napierala 		rulecnt--;
1642ec125fbbSEdward Tomasz Napierala 	}
1643ec125fbbSEdward Tomasz Napierala 
1644ec125fbbSEdward Tomasz Napierala 	if (rulecnt == 0) {
1645ec125fbbSEdward Tomasz Napierala 		/*
1646ec125fbbSEdward Tomasz Napierala 		 * Free the old rule list.
1647ec125fbbSEdward Tomasz Napierala 		 */
1648ec125fbbSEdward Tomasz Napierala 		while (!LIST_EMPTY(&p->p_racct->r_rule_links)) {
1649ec125fbbSEdward Tomasz Napierala 			link = LIST_FIRST(&p->p_racct->r_rule_links);
1650ec125fbbSEdward Tomasz Napierala 			LIST_REMOVE(link, rrl_next);
1651ec125fbbSEdward Tomasz Napierala 			rctl_rule_release(link->rrl_rule);
1652ec125fbbSEdward Tomasz Napierala 			uma_zfree(rctl_rule_link_zone, link);
1653ec125fbbSEdward Tomasz Napierala 		}
1654ec125fbbSEdward Tomasz Napierala 
1655ec125fbbSEdward Tomasz Napierala 		/*
1656ec125fbbSEdward Tomasz Napierala 		 * Replace lists and we're done.
1657ec125fbbSEdward Tomasz Napierala 		 *
1658ec125fbbSEdward Tomasz Napierala 		 * XXX: Is there any way to switch list heads instead
1659ec125fbbSEdward Tomasz Napierala 		 *      of iterating here?
1660ec125fbbSEdward Tomasz Napierala 		 */
1661ec125fbbSEdward Tomasz Napierala 		while (!LIST_EMPTY(&newrules)) {
1662ec125fbbSEdward Tomasz Napierala 			newlink = LIST_FIRST(&newrules);
1663ec125fbbSEdward Tomasz Napierala 			LIST_REMOVE(newlink, rrl_next);
1664ec125fbbSEdward Tomasz Napierala 			LIST_INSERT_HEAD(&p->p_racct->r_rule_links,
1665ec125fbbSEdward Tomasz Napierala 			    newlink, rrl_next);
1666ec125fbbSEdward Tomasz Napierala 		}
1667ec125fbbSEdward Tomasz Napierala 
1668ec125fbbSEdward Tomasz Napierala 		rw_wunlock(&rctl_lock);
1669ec125fbbSEdward Tomasz Napierala 
1670ec125fbbSEdward Tomasz Napierala 		return;
1671ec125fbbSEdward Tomasz Napierala 	}
1672ec125fbbSEdward Tomasz Napierala 
1673ec125fbbSEdward Tomasz Napierala goaround:
1674ec125fbbSEdward Tomasz Napierala 	rw_wunlock(&rctl_lock);
1675ec125fbbSEdward Tomasz Napierala 
1676ec125fbbSEdward Tomasz Napierala 	/*
1677ec125fbbSEdward Tomasz Napierala 	 * Rule list changed while we were not holding the rctl_lock.
1678ec125fbbSEdward Tomasz Napierala 	 * Free the new list and try again.
1679ec125fbbSEdward Tomasz Napierala 	 */
1680ec125fbbSEdward Tomasz Napierala 	while (!LIST_EMPTY(&newrules)) {
1681ec125fbbSEdward Tomasz Napierala 		newlink = LIST_FIRST(&newrules);
1682ec125fbbSEdward Tomasz Napierala 		LIST_REMOVE(newlink, rrl_next);
1683ec125fbbSEdward Tomasz Napierala 		if (newlink->rrl_rule != NULL)
1684ec125fbbSEdward Tomasz Napierala 			rctl_rule_release(newlink->rrl_rule);
1685ec125fbbSEdward Tomasz Napierala 		uma_zfree(rctl_rule_link_zone, newlink);
1686ec125fbbSEdward Tomasz Napierala 	}
1687ec125fbbSEdward Tomasz Napierala 
1688ec125fbbSEdward Tomasz Napierala 	goto again;
1689ec125fbbSEdward Tomasz Napierala }
1690ec125fbbSEdward Tomasz Napierala 
1691ec125fbbSEdward Tomasz Napierala /*
1692ec125fbbSEdward Tomasz Napierala  * Assign RCTL rules to the newly created process.
1693ec125fbbSEdward Tomasz Napierala  */
1694ec125fbbSEdward Tomasz Napierala int
1695ec125fbbSEdward Tomasz Napierala rctl_proc_fork(struct proc *parent, struct proc *child)
1696ec125fbbSEdward Tomasz Napierala {
1697ec125fbbSEdward Tomasz Napierala 	int error;
1698ec125fbbSEdward Tomasz Napierala 	struct rctl_rule_link *link;
1699ec125fbbSEdward Tomasz Napierala 	struct rctl_rule *rule;
1700ec125fbbSEdward Tomasz Napierala 
1701ec125fbbSEdward Tomasz Napierala 	LIST_INIT(&child->p_racct->r_rule_links);
1702ec125fbbSEdward Tomasz Napierala 
1703ec125fbbSEdward Tomasz Napierala 	/*
1704ec125fbbSEdward Tomasz Napierala 	 * No limits for kernel processes.
1705ec125fbbSEdward Tomasz Napierala 	 */
1706ec125fbbSEdward Tomasz Napierala 	if (child->p_flag & P_SYSTEM)
1707ec125fbbSEdward Tomasz Napierala 		return (0);
1708ec125fbbSEdward Tomasz Napierala 
1709ec125fbbSEdward Tomasz Napierala 	/*
1710ec125fbbSEdward Tomasz Napierala 	 * Nothing to inherit from P_SYSTEM parents.
1711ec125fbbSEdward Tomasz Napierala 	 */
1712ec125fbbSEdward Tomasz Napierala 	if (parent->p_racct == NULL) {
1713ec125fbbSEdward Tomasz Napierala 		KASSERT(parent->p_flag & P_SYSTEM,
1714ec125fbbSEdward Tomasz Napierala 		    ("non-system process without racct; p = %p", parent));
1715ec125fbbSEdward Tomasz Napierala 		return (0);
1716ec125fbbSEdward Tomasz Napierala 	}
1717ec125fbbSEdward Tomasz Napierala 
1718ec125fbbSEdward Tomasz Napierala 	rw_wlock(&rctl_lock);
1719ec125fbbSEdward Tomasz Napierala 
1720ec125fbbSEdward Tomasz Napierala 	/*
1721ec125fbbSEdward Tomasz Napierala 	 * Go through limits applicable to the parent and assign them
1722ec125fbbSEdward Tomasz Napierala 	 * to the child.  Rules with 'process' subject have to be duplicated
1723ec125fbbSEdward Tomasz Napierala 	 * in order to make their rr_subject point to the new process.
1724ec125fbbSEdward Tomasz Napierala 	 */
1725ec125fbbSEdward Tomasz Napierala 	LIST_FOREACH(link, &parent->p_racct->r_rule_links, rrl_next) {
1726ec125fbbSEdward Tomasz Napierala 		if (link->rrl_rule->rr_subject_type ==
1727ec125fbbSEdward Tomasz Napierala 		    RCTL_SUBJECT_TYPE_PROCESS) {
1728ec125fbbSEdward Tomasz Napierala 			rule = rctl_rule_duplicate(link->rrl_rule, M_NOWAIT);
1729ec125fbbSEdward Tomasz Napierala 			if (rule == NULL)
1730ec125fbbSEdward Tomasz Napierala 				goto fail;
1731ec125fbbSEdward Tomasz Napierala 			KASSERT(rule->rr_subject.rs_proc == parent,
1732ec125fbbSEdward Tomasz Napierala 			    ("rule->rr_subject.rs_proc != parent"));
1733ec125fbbSEdward Tomasz Napierala 			rule->rr_subject.rs_proc = child;
1734ec125fbbSEdward Tomasz Napierala 			error = rctl_racct_add_rule_locked(child->p_racct,
1735ec125fbbSEdward Tomasz Napierala 			    rule);
1736ec125fbbSEdward Tomasz Napierala 			rctl_rule_release(rule);
1737ec125fbbSEdward Tomasz Napierala 			if (error != 0)
1738ec125fbbSEdward Tomasz Napierala 				goto fail;
1739ec125fbbSEdward Tomasz Napierala 		} else {
1740ec125fbbSEdward Tomasz Napierala 			error = rctl_racct_add_rule_locked(child->p_racct,
1741ec125fbbSEdward Tomasz Napierala 			    link->rrl_rule);
1742ec125fbbSEdward Tomasz Napierala 			if (error != 0)
1743ec125fbbSEdward Tomasz Napierala 				goto fail;
1744ec125fbbSEdward Tomasz Napierala 		}
1745ec125fbbSEdward Tomasz Napierala 	}
1746ec125fbbSEdward Tomasz Napierala 
1747ec125fbbSEdward Tomasz Napierala 	rw_wunlock(&rctl_lock);
1748ec125fbbSEdward Tomasz Napierala 	return (0);
1749ec125fbbSEdward Tomasz Napierala 
1750ec125fbbSEdward Tomasz Napierala fail:
1751ec125fbbSEdward Tomasz Napierala 	while (!LIST_EMPTY(&child->p_racct->r_rule_links)) {
1752ec125fbbSEdward Tomasz Napierala 		link = LIST_FIRST(&child->p_racct->r_rule_links);
1753ec125fbbSEdward Tomasz Napierala 		LIST_REMOVE(link, rrl_next);
1754ec125fbbSEdward Tomasz Napierala 		rctl_rule_release(link->rrl_rule);
1755ec125fbbSEdward Tomasz Napierala 		uma_zfree(rctl_rule_link_zone, link);
1756ec125fbbSEdward Tomasz Napierala 	}
1757ec125fbbSEdward Tomasz Napierala 	rw_wunlock(&rctl_lock);
1758ec125fbbSEdward Tomasz Napierala 	return (EAGAIN);
1759ec125fbbSEdward Tomasz Napierala }
1760ec125fbbSEdward Tomasz Napierala 
1761ec125fbbSEdward Tomasz Napierala /*
1762ec125fbbSEdward Tomasz Napierala  * Release rules attached to the racct.
1763ec125fbbSEdward Tomasz Napierala  */
1764ec125fbbSEdward Tomasz Napierala void
1765ec125fbbSEdward Tomasz Napierala rctl_racct_release(struct racct *racct)
1766ec125fbbSEdward Tomasz Napierala {
1767ec125fbbSEdward Tomasz Napierala 	struct rctl_rule_link *link;
1768ec125fbbSEdward Tomasz Napierala 
1769ec125fbbSEdward Tomasz Napierala 	rw_wlock(&rctl_lock);
1770ec125fbbSEdward Tomasz Napierala 	while (!LIST_EMPTY(&racct->r_rule_links)) {
1771ec125fbbSEdward Tomasz Napierala 		link = LIST_FIRST(&racct->r_rule_links);
1772ec125fbbSEdward Tomasz Napierala 		LIST_REMOVE(link, rrl_next);
1773ec125fbbSEdward Tomasz Napierala 		rctl_rule_release(link->rrl_rule);
1774ec125fbbSEdward Tomasz Napierala 		uma_zfree(rctl_rule_link_zone, link);
1775ec125fbbSEdward Tomasz Napierala 	}
1776ec125fbbSEdward Tomasz Napierala 	rw_wunlock(&rctl_lock);
1777ec125fbbSEdward Tomasz Napierala }
1778ec125fbbSEdward Tomasz Napierala 
1779ec125fbbSEdward Tomasz Napierala static void
1780ec125fbbSEdward Tomasz Napierala rctl_init(void)
1781ec125fbbSEdward Tomasz Napierala {
1782ec125fbbSEdward Tomasz Napierala 
1783ec125fbbSEdward Tomasz Napierala 	rctl_rule_link_zone = uma_zcreate("rctl_rule_link",
1784ec125fbbSEdward Tomasz Napierala 	    sizeof(struct rctl_rule_link), NULL, NULL, NULL, NULL,
1785ec125fbbSEdward Tomasz Napierala 	    UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
1786ec125fbbSEdward Tomasz Napierala 	rctl_rule_zone = uma_zcreate("rctl_rule", sizeof(struct rctl_rule),
1787ec125fbbSEdward Tomasz Napierala 	    NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
1788ec125fbbSEdward Tomasz Napierala }
1789ec125fbbSEdward Tomasz Napierala 
1790ec125fbbSEdward Tomasz Napierala #else /* !RCTL */
1791ec125fbbSEdward Tomasz Napierala 
1792ec125fbbSEdward Tomasz Napierala int
1793ec125fbbSEdward Tomasz Napierala rctl_get_racct(struct thread *td, struct rctl_get_racct_args *uap)
1794ec125fbbSEdward Tomasz Napierala {
1795ec125fbbSEdward Tomasz Napierala 
1796ec125fbbSEdward Tomasz Napierala 	return (ENOSYS);
1797ec125fbbSEdward Tomasz Napierala }
1798ec125fbbSEdward Tomasz Napierala 
1799ec125fbbSEdward Tomasz Napierala int
1800ec125fbbSEdward Tomasz Napierala rctl_get_rules(struct thread *td, struct rctl_get_rules_args *uap)
1801ec125fbbSEdward Tomasz Napierala {
1802ec125fbbSEdward Tomasz Napierala 
1803ec125fbbSEdward Tomasz Napierala 	return (ENOSYS);
1804ec125fbbSEdward Tomasz Napierala }
1805ec125fbbSEdward Tomasz Napierala 
1806ec125fbbSEdward Tomasz Napierala int
1807ec125fbbSEdward Tomasz Napierala rctl_get_limits(struct thread *td, struct rctl_get_limits_args *uap)
1808ec125fbbSEdward Tomasz Napierala {
1809ec125fbbSEdward Tomasz Napierala 
1810ec125fbbSEdward Tomasz Napierala 	return (ENOSYS);
1811ec125fbbSEdward Tomasz Napierala }
1812ec125fbbSEdward Tomasz Napierala 
1813ec125fbbSEdward Tomasz Napierala int
1814ec125fbbSEdward Tomasz Napierala rctl_add_rule(struct thread *td, struct rctl_add_rule_args *uap)
1815ec125fbbSEdward Tomasz Napierala {
1816ec125fbbSEdward Tomasz Napierala 
1817ec125fbbSEdward Tomasz Napierala 	return (ENOSYS);
1818ec125fbbSEdward Tomasz Napierala }
1819ec125fbbSEdward Tomasz Napierala 
1820ec125fbbSEdward Tomasz Napierala int
1821ec125fbbSEdward Tomasz Napierala rctl_remove_rule(struct thread *td, struct rctl_remove_rule_args *uap)
1822ec125fbbSEdward Tomasz Napierala {
1823ec125fbbSEdward Tomasz Napierala 
1824ec125fbbSEdward Tomasz Napierala 	return (ENOSYS);
1825ec125fbbSEdward Tomasz Napierala }
1826ec125fbbSEdward Tomasz Napierala 
1827ec125fbbSEdward Tomasz Napierala #endif /* !RCTL */
1828