mirror of
https://github.com/BastilleBSD/bastille.git
synced 2025-12-11 01:19:52 +01:00
Merge pull request #910 from BastilleBSD/limits-clear-reset
limits: Add clear, reset, stats, show, add, remove as commands
This commit is contained in:
Barry McCormick
GitHub
@@ -3,12 +3,20 @@ limits
|
||||
|
||||
Set resourse limits for targeted jail(s).
|
||||
|
||||
To add a limit, use `bastille limits TARGET add OPTION VALUE`
|
||||
|
||||
To clear the limits from the system, use `bastille limits TARGET clear`
|
||||
|
||||
To clear the limits, and remove the rctl.conf, use `bastille limits TARGET reset`
|
||||
|
||||
To remove a limit, use `bastille limits TARGET remove OPTION`
|
||||
|
||||
.. code-block:: shell
|
||||
|
||||
ishmael ~ # bastille limits help
|
||||
|
||||
Usage: bastille limits [option(s)] TARGET OPTION VALUE"
|
||||
Example: bastille limits JAILNAME memoryuse 1G"
|
||||
Usage: bastille limits [option(s)] TARGET [add OPTION VALUE|remove OPTION|clear|reset|[list|show] (active)|stats]
|
||||
Example: bastille limits TARGET add memoryuse 1G"
|
||||
|
||||
Options:
|
||||
|
||||
|
||||
@@ -34,8 +34,8 @@
|
||||
. /usr/local/share/bastille/common.sh
|
||||
|
||||
usage() {
|
||||
error_notify "Usage: bastille limits [option(s)] TARGET OPTION VALUE"
|
||||
echo -e "Example: bastille limits JAILNAME memoryuse 1G"
|
||||
error_notify "Usage: bastille limits [option(s)] TARGET [add OPTION VALUE|remove OPTION|clear|reset|[list|show] (active)|stats]"
|
||||
echo -e "Example: bastille limits TARGET add memoryuse 1G"
|
||||
cat << EOF
|
||||
Options:
|
||||
|
||||
@@ -77,13 +77,21 @@ while [ "$#" -gt 0 ]; do
|
||||
esac
|
||||
done
|
||||
|
||||
if [ $# -ne 3 ]; then
|
||||
if [ "$#" -lt 2 ] || [ "$#" -gt 4 ]; then
|
||||
usage
|
||||
fi
|
||||
|
||||
TARGET="${1}"
|
||||
OPTION="${2}"
|
||||
VALUE="${3}"
|
||||
ACTION="${2}"
|
||||
# Retain support for no action (will default to add)
|
||||
if [ "${ACTION}" != "add" ] && [ "${ACTION}" != "remove" ] && [ "${ACTION}" != "clear" ] && [ "${ACTION}" != "list" ] && [ "${ACTION}" != "show" ] && [ "${ACTION}" != "reset" ] && [ "${ACTION}" != "stats" ]; then
|
||||
ACTION="add"
|
||||
shift 1
|
||||
else
|
||||
ACTION="${2}"
|
||||
shift 2
|
||||
fi
|
||||
|
||||
RACCT_ENABLE="$(sysctl -n kern.racct.enable)"
|
||||
if [ "${RACCT_ENABLE}" != '1' ]; then
|
||||
error_exit "Racct not enabled. Append 'kern.racct.enable=1' to /boot/loader.conf and reboot"
|
||||
@@ -102,23 +110,81 @@ for _jail in ${JAILS}; do
|
||||
error_notify "Jail is not running."
|
||||
error_continue "Use [-a|--auto] to auto-start the jail."
|
||||
fi
|
||||
|
||||
case "${ACTION}" in
|
||||
add)
|
||||
OPTION="${1}"
|
||||
VALUE="${2}"
|
||||
# Add rctl rule to rctl.conf
|
||||
_rctl_rule="jail:${_jail}:${OPTION}:deny=${VALUE}/jail"
|
||||
_rctl_rule_log="jail:${_jail}:${OPTION}:log=${VALUE}/jail"
|
||||
|
||||
_rctl_rule="jail:${_jail}:${OPTION}:deny=${VALUE}/jail"
|
||||
_rctl_rule_log="jail:${_jail}:${OPTION}:log=${VALUE}/jail"
|
||||
|
||||
# Check whether the entry already exists and, if so, update it. -- cwells
|
||||
if grep -qs "jail:${_jail}:${OPTION}:deny" "${bastille_jailsdir}/${_jail}/rctl.conf"; then
|
||||
_escaped_option=$(echo "${OPTION}" | sed 's/\//\\\//g')
|
||||
_escaped_rctl_rule=$(echo "${_rctl_rule}" | sed 's/\//\\\//g')
|
||||
_escaped_rctl_rule_log=$(echo "${_rctl_rule_log}" | sed 's/\//\\\//g')
|
||||
sed -i '' -E "s/jail:${_jail}:${_escaped_option}:deny.+/${_escaped_rctl_rule}/" "${bastille_jailsdir}/${_jail}/rctl.conf"
|
||||
sed -i '' -E "s/jail:${_jail}:${_escaped_option}:log.+/${_escaped_rctl_rule_log}/" "${bastille_jailsdir}/${_jail}/rctl.conf"
|
||||
else # Just append the entry. -- cwells
|
||||
echo "${_rctl_rule}" >> "${bastille_jailsdir}/${_jail}/rctl.conf"
|
||||
echo "${_rctl_rule_log}" >> "${bastille_jailsdir}/${_jail}/rctl.conf"
|
||||
fi
|
||||
|
||||
echo -e "${OPTION} ${VALUE}"
|
||||
rctl -a "${_rctl_rule}" "${_rctl_rule_log}"
|
||||
# Check whether the entry already exists and, if so, update it. -- cwells
|
||||
if grep -qs "jail:${_jail}:${OPTION}:deny" "${bastille_jailsdir}/${_jail}/rctl.conf"; then
|
||||
_escaped_option=$(echo "${OPTION}" | sed 's/\//\\\//g')
|
||||
_escaped_rctl_rule=$(echo "${_rctl_rule}" | sed 's/\//\\\//g')
|
||||
_escaped_rctl_rule_log=$(echo "${_rctl_rule_log}" | sed 's/\//\\\//g')
|
||||
sed -i '' -E "s/jail:${_jail}:${_escaped_option}:deny.+/${_escaped_rctl_rule}/" "${bastille_jailsdir}/${_jail}/rctl.conf"
|
||||
sed -i '' -E "s/jail:${_jail}:${_escaped_option}:log.+/${_escaped_rctl_rule_log}/" "${bastille_jailsdir}/${_jail}/rctl.conf"
|
||||
else # Just append the entry. -- cwells
|
||||
echo "${_rctl_rule}" >> "${bastille_jailsdir}/${_jail}/rctl.conf"
|
||||
echo "${_rctl_rule_log}" >> "${bastille_jailsdir}/${_jail}/rctl.conf"
|
||||
fi
|
||||
|
||||
echo -e "${OPTION} ${VALUE}"
|
||||
rctl -a "${_rctl_rule}" "${_rctl_rule_log}"
|
||||
;;
|
||||
remove)
|
||||
OPTION="${1}"
|
||||
# Remove rule from rctl.conf
|
||||
if [ -s "${bastille_jailsdir}/${_jail}/rctl.conf" ]; then
|
||||
if grep -qs "jail:${_jail}:${OPTION}:deny" "${bastille_jailsdir}/${_jail}/rctl.conf"; then
|
||||
_rctl_rule="$(grep "jail:${_jail}:${OPTION}:deny" "${bastille_jailsdir}/${_jail}/rctl.conf")"
|
||||
_rctl_rule_log="$(grep "jail:${_jail}:${OPTION}:log" "${bastille_jailsdir}/${_jail}/rctl.conf")"
|
||||
rctl -r "${_rctl_rule}" "${_rctl_rule_log}" 2>/dev/null
|
||||
sed -i '' "/.*${_jail}:${OPTION}.*/d" "${bastille_jailsdir}/${_jail}/rctl.conf"
|
||||
fi
|
||||
fi
|
||||
;;
|
||||
clear)
|
||||
# Remove limits
|
||||
if [ -s "${bastille_jailsdir}/${_jail}/rctl.conf" ]; then
|
||||
while read _limits; do
|
||||
rctl -r "${_limits}" 2>/dev/null
|
||||
done < "${bastille_jailsdir}/${_jail}/rctl.conf"
|
||||
info "[${_jail}]: RCTL limits cleared."
|
||||
fi
|
||||
;;
|
||||
list|show)
|
||||
# Show limits
|
||||
if [ -s "${bastille_jailsdir}/${_jail}/rctl.conf" ]; then
|
||||
if [ "${1}" = "active" ]; then
|
||||
rctl jail:${_jail} 2>/dev/null
|
||||
else
|
||||
cat "${bastille_jailsdir}/${_jail}/rctl.conf"
|
||||
fi
|
||||
fi
|
||||
;;
|
||||
stats)
|
||||
# Show statistics
|
||||
if [ -s "${bastille_jailsdir}/${_jail}/rctl.conf" ]; then
|
||||
rctl -hu jail:${_jail} 2>/dev/null
|
||||
fi
|
||||
;;
|
||||
reset)
|
||||
# Remove limits and delete rctl.conf
|
||||
if [ -s "${bastille_jailsdir}/${_jail}/rctl.conf" ]; then
|
||||
while read _limits; do
|
||||
rctl -r "${_limits}" 2>/dev/null
|
||||
done < "${bastille_jailsdir}/${_jail}/rctl.conf"
|
||||
info "[${TARGET}]: RCTL limits cleared."
|
||||
fi
|
||||
if [ -s "${bastille_jailsdir}/${_jail}/rctl.conf" ]; then
|
||||
rm -f "${bastille_jailsdir}/${_jail}/rctl.conf"
|
||||
info "[${TARGET}]: rctl.conf removed."
|
||||
else
|
||||
error_continue "[${TARGET}]: rctl.conf not found."
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
@@ -129,9 +129,7 @@ for _jail in ${JAILS}; do
|
||||
|
||||
# Remove rctl limits
|
||||
if [ -s "${bastille_jailsdir}/${_jail}/rctl.conf" ]; then
|
||||
while read _limits; do
|
||||
rctl -r "${_limits}"
|
||||
done < "${bastille_jailsdir}/${_jail}/rctl.conf"
|
||||
bastille limits "${_jail}" clear
|
||||
fi
|
||||
|
||||
# Stop jail
|
||||
|
||||
Reference in New Issue
Block a user