diff --git a/docs/chapters/subcommands/limits.rst b/docs/chapters/subcommands/limits.rst index 7aee8be4..33f66d63 100644 --- a/docs/chapters/subcommands/limits.rst +++ b/docs/chapters/subcommands/limits.rst @@ -3,12 +3,20 @@ limits Set resourse limits for targeted jail(s). +To add a limit, use `bastille limits TARGET add OPTION VALUE` + +To clear the limits from the system, use `bastille limits TARGET clear` + +To clear the limits, and remove the rctl.conf, use `bastille limits TARGET reset` + +To remove a limit, use `bastille limits TARGET remove OPTION` + .. code-block:: shell ishmael ~ # bastille limits help - Usage: bastille limits [option(s)] TARGET OPTION VALUE" - Example: bastille limits JAILNAME memoryuse 1G" + Usage: bastille limits [option(s)] TARGET [add OPTION VALUE|remove OPTION|clear|reset|[list|show] (active)|stats] + Example: bastille limits TARGET add memoryuse 1G" Options: diff --git a/usr/local/share/bastille/limits.sh b/usr/local/share/bastille/limits.sh index 19a2f8af..c061d647 100644 --- a/usr/local/share/bastille/limits.sh +++ b/usr/local/share/bastille/limits.sh @@ -34,8 +34,8 @@ . /usr/local/share/bastille/common.sh usage() { - error_notify "Usage: bastille limits [option(s)] TARGET OPTION VALUE" - echo -e "Example: bastille limits JAILNAME memoryuse 1G" + error_notify "Usage: bastille limits [option(s)] TARGET [add OPTION VALUE|remove OPTION|clear|reset|[list|show] (active)|stats]" + echo -e "Example: bastille limits TARGET add memoryuse 1G" cat << EOF Options: @@ -77,13 +77,21 @@ while [ "$#" -gt 0 ]; do esac done -if [ $# -ne 3 ]; then +if [ "$#" -lt 2 ] || [ "$#" -gt 4 ]; then usage fi TARGET="${1}" -OPTION="${2}" -VALUE="${3}" +ACTION="${2}" +# Retain support for no action (will default to add) +if [ "${ACTION}" != "add" ] && [ "${ACTION}" != "remove" ] && [ "${ACTION}" != "clear" ] && [ "${ACTION}" != "list" ] && [ "${ACTION}" != "show" ] && [ "${ACTION}" != "reset" ] && [ "${ACTION}" != "stats" ]; then + ACTION="add" + shift 1 +else + ACTION="${2}" + shift 2 +fi + RACCT_ENABLE="$(sysctl -n kern.racct.enable)" if [ "${RACCT_ENABLE}" != '1' ]; then error_exit "Racct not enabled. Append 'kern.racct.enable=1' to /boot/loader.conf and reboot" @@ -102,23 +110,81 @@ for _jail in ${JAILS}; do error_notify "Jail is not running." error_continue "Use [-a|--auto] to auto-start the jail." fi + + case "${ACTION}" in + add) + OPTION="${1}" + VALUE="${2}" + # Add rctl rule to rctl.conf + _rctl_rule="jail:${_jail}:${OPTION}:deny=${VALUE}/jail" + _rctl_rule_log="jail:${_jail}:${OPTION}:log=${VALUE}/jail" - _rctl_rule="jail:${_jail}:${OPTION}:deny=${VALUE}/jail" - _rctl_rule_log="jail:${_jail}:${OPTION}:log=${VALUE}/jail" - - # Check whether the entry already exists and, if so, update it. -- cwells - if grep -qs "jail:${_jail}:${OPTION}:deny" "${bastille_jailsdir}/${_jail}/rctl.conf"; then - _escaped_option=$(echo "${OPTION}" | sed 's/\//\\\//g') - _escaped_rctl_rule=$(echo "${_rctl_rule}" | sed 's/\//\\\//g') - _escaped_rctl_rule_log=$(echo "${_rctl_rule_log}" | sed 's/\//\\\//g') - sed -i '' -E "s/jail:${_jail}:${_escaped_option}:deny.+/${_escaped_rctl_rule}/" "${bastille_jailsdir}/${_jail}/rctl.conf" - sed -i '' -E "s/jail:${_jail}:${_escaped_option}:log.+/${_escaped_rctl_rule_log}/" "${bastille_jailsdir}/${_jail}/rctl.conf" - else # Just append the entry. -- cwells - echo "${_rctl_rule}" >> "${bastille_jailsdir}/${_jail}/rctl.conf" - echo "${_rctl_rule_log}" >> "${bastille_jailsdir}/${_jail}/rctl.conf" - fi - - echo -e "${OPTION} ${VALUE}" - rctl -a "${_rctl_rule}" "${_rctl_rule_log}" + # Check whether the entry already exists and, if so, update it. -- cwells + if grep -qs "jail:${_jail}:${OPTION}:deny" "${bastille_jailsdir}/${_jail}/rctl.conf"; then + _escaped_option=$(echo "${OPTION}" | sed 's/\//\\\//g') + _escaped_rctl_rule=$(echo "${_rctl_rule}" | sed 's/\//\\\//g') + _escaped_rctl_rule_log=$(echo "${_rctl_rule_log}" | sed 's/\//\\\//g') + sed -i '' -E "s/jail:${_jail}:${_escaped_option}:deny.+/${_escaped_rctl_rule}/" "${bastille_jailsdir}/${_jail}/rctl.conf" + sed -i '' -E "s/jail:${_jail}:${_escaped_option}:log.+/${_escaped_rctl_rule_log}/" "${bastille_jailsdir}/${_jail}/rctl.conf" + else # Just append the entry. -- cwells + echo "${_rctl_rule}" >> "${bastille_jailsdir}/${_jail}/rctl.conf" + echo "${_rctl_rule_log}" >> "${bastille_jailsdir}/${_jail}/rctl.conf" + fi + echo -e "${OPTION} ${VALUE}" + rctl -a "${_rctl_rule}" "${_rctl_rule_log}" + ;; + remove) + OPTION="${1}" + # Remove rule from rctl.conf + if [ -s "${bastille_jailsdir}/${_jail}/rctl.conf" ]; then + if grep -qs "jail:${_jail}:${OPTION}:deny" "${bastille_jailsdir}/${_jail}/rctl.conf"; then + _rctl_rule="$(grep "jail:${_jail}:${OPTION}:deny" "${bastille_jailsdir}/${_jail}/rctl.conf")" + _rctl_rule_log="$(grep "jail:${_jail}:${OPTION}:log" "${bastille_jailsdir}/${_jail}/rctl.conf")" + rctl -r "${_rctl_rule}" "${_rctl_rule_log}" 2>/dev/null + sed -i '' "/.*${_jail}:${OPTION}.*/d" "${bastille_jailsdir}/${_jail}/rctl.conf" + fi + fi + ;; + clear) + # Remove limits + if [ -s "${bastille_jailsdir}/${_jail}/rctl.conf" ]; then + while read _limits; do + rctl -r "${_limits}" 2>/dev/null + done < "${bastille_jailsdir}/${_jail}/rctl.conf" + info "[${_jail}]: RCTL limits cleared." + fi + ;; + list|show) + # Show limits + if [ -s "${bastille_jailsdir}/${_jail}/rctl.conf" ]; then + if [ "${1}" = "active" ]; then + rctl jail:${_jail} 2>/dev/null + else + cat "${bastille_jailsdir}/${_jail}/rctl.conf" + fi + fi + ;; + stats) + # Show statistics + if [ -s "${bastille_jailsdir}/${_jail}/rctl.conf" ]; then + rctl -hu jail:${_jail} 2>/dev/null + fi + ;; + reset) + # Remove limits and delete rctl.conf + if [ -s "${bastille_jailsdir}/${_jail}/rctl.conf" ]; then + while read _limits; do + rctl -r "${_limits}" 2>/dev/null + done < "${bastille_jailsdir}/${_jail}/rctl.conf" + info "[${TARGET}]: RCTL limits cleared." + fi + if [ -s "${bastille_jailsdir}/${_jail}/rctl.conf" ]; then + rm -f "${bastille_jailsdir}/${_jail}/rctl.conf" + info "[${TARGET}]: rctl.conf removed." + else + error_continue "[${TARGET}]: rctl.conf not found." + fi + ;; + esac done diff --git a/usr/local/share/bastille/stop.sh b/usr/local/share/bastille/stop.sh index d7bb1350..d0d080a6 100644 --- a/usr/local/share/bastille/stop.sh +++ b/usr/local/share/bastille/stop.sh @@ -129,9 +129,7 @@ for _jail in ${JAILS}; do # Remove rctl limits if [ -s "${bastille_jailsdir}/${_jail}/rctl.conf" ]; then - while read _limits; do - rctl -r "${_limits}" - done < "${bastille_jailsdir}/${_jail}/rctl.conf" + bastille limits "${_jail}" clear fi # Stop jail