Merge pull request #910 from BastilleBSD/limits-clear-reset

limits: Add clear, reset, stats, show, add, remove  as commands

docs/chapters/subcommands/limits.rst

@@ -3,12 +3,20 @@ limits
 
 Set resourse limits for targeted jail(s).
 
+To add a limit, use `bastille limits TARGET add OPTION VALUE`
+
+To clear the limits from the system, use `bastille limits TARGET clear`
+
+To clear the limits, and remove the rctl.conf, use `bastille limits TARGET reset`
+
+To remove a limit, use `bastille limits TARGET remove OPTION`
+
 .. code-block:: shell
 
   ishmael ~ # bastille limits help
 
-  Usage: bastille limits [option(s)] TARGET OPTION VALUE"
+  Usage: bastille limits [option(s)] TARGET [add OPTION VALUE|remove OPTION|clear|reset|[list|show] (active)|stats]
-  Example: bastille limits JAILNAME memoryuse 1G"
+  Example: bastille limits TARGET add memoryuse 1G"
   
     Options:
 

usr/local/share/bastille/limits.sh

@@ -34,8 +34,8 @@
 . /usr/local/share/bastille/common.sh
 
 usage() {
-    error_notify "Usage: bastille limits [option(s)] TARGET OPTION VALUE"
+    error_notify "Usage: bastille limits [option(s)] TARGET [add OPTION VALUE|remove OPTION|clear|reset|[list|show] (active)|stats]"
-    echo -e "Example: bastille limits JAILNAME memoryuse 1G"
+    echo -e "Example: bastille limits TARGET add memoryuse 1G"
     cat << EOF
     Options:
 
@@ -77,13 +77,21 @@ while [ "$#" -gt 0 ]; do
     esac
 done
 
-if [ $# -ne 3 ]; then
+if [ "$#" -lt 2 ] || [ "$#" -gt 4 ]; then
     usage
 fi
 
 TARGET="${1}"
-OPTION="${2}"
+ACTION="${2}"
-VALUE="${3}"
+# Retain support for no action (will default to add) 
+if [ "${ACTION}" != "add" ] && [ "${ACTION}" != "remove" ] && [ "${ACTION}" != "clear" ] && [ "${ACTION}" != "list" ] && [ "${ACTION}" != "show" ] && [ "${ACTION}" != "reset" ] && [ "${ACTION}" != "stats" ]; then
+    ACTION="add"
+    shift 1
+else
+    ACTION="${2}"
+    shift 2
+fi
+
 RACCT_ENABLE="$(sysctl -n kern.racct.enable)"
 if [ "${RACCT_ENABLE}" != '1' ]; then
     error_exit "Racct not enabled. Append 'kern.racct.enable=1' to /boot/loader.conf and reboot"
@@ -103,6 +111,11 @@ for _jail in ${JAILS}; do
         error_continue "Use [-a|--auto] to auto-start the jail."
     fi
     
+    case "${ACTION}" in
+        add)
+            OPTION="${1}"
+            VALUE="${2}"
+            # Add rctl rule to rctl.conf
             _rctl_rule="jail:${_jail}:${OPTION}:deny=${VALUE}/jail"
             _rctl_rule_log="jail:${_jail}:${OPTION}:log=${VALUE}/jail"
 
@@ -120,5 +133,58 @@ for _jail in ${JAILS}; do
 
             echo -e "${OPTION} ${VALUE}"
             rctl -a "${_rctl_rule}" "${_rctl_rule_log}"
-
+            ;;
+        remove)
+            OPTION="${1}"
+            # Remove rule from rctl.conf
+            if [ -s "${bastille_jailsdir}/${_jail}/rctl.conf" ]; then
+                if grep -qs "jail:${_jail}:${OPTION}:deny" "${bastille_jailsdir}/${_jail}/rctl.conf"; then
+                    _rctl_rule="$(grep "jail:${_jail}:${OPTION}:deny" "${bastille_jailsdir}/${_jail}/rctl.conf")"
+                    _rctl_rule_log="$(grep "jail:${_jail}:${OPTION}:log" "${bastille_jailsdir}/${_jail}/rctl.conf")"
+                    rctl -r "${_rctl_rule}" "${_rctl_rule_log}" 2>/dev/null
+                    sed -i '' "/.*${_jail}:${OPTION}.*/d" "${bastille_jailsdir}/${_jail}/rctl.conf"
+                fi
+            fi
+            ;;
+        clear)
+            # Remove limits
+            if [ -s "${bastille_jailsdir}/${_jail}/rctl.conf" ]; then
+                while read _limits; do
+                    rctl -r "${_limits}" 2>/dev/null
+                done < "${bastille_jailsdir}/${_jail}/rctl.conf"
+                info "[${_jail}]: RCTL limits cleared."
+            fi
+	        ;;
+        list|show)
+            # Show limits
+            if [ -s "${bastille_jailsdir}/${_jail}/rctl.conf" ]; then
+	        if [ "${1}" = "active" ]; then
+	            rctl jail:${_jail} 2>/dev/null
+	        else
+	            cat "${bastille_jailsdir}/${_jail}/rctl.conf"
+	        fi
+            fi
+            ;;
+        stats)
+            # Show statistics
+            if [ -s "${bastille_jailsdir}/${_jail}/rctl.conf" ]; then
+	        rctl -hu jail:${_jail} 2>/dev/null
+            fi
+            ;;
+        reset)
+            # Remove limits and delete rctl.conf
+	    if [ -s "${bastille_jailsdir}/${_jail}/rctl.conf" ]; then
+                while read _limits; do
+                    rctl -r "${_limits}" 2>/dev/null
+                done < "${bastille_jailsdir}/${_jail}/rctl.conf"
+	        info "[${TARGET}]: RCTL limits cleared."
+            fi
+            if [ -s "${bastille_jailsdir}/${_jail}/rctl.conf" ]; then
+                rm -f "${bastille_jailsdir}/${_jail}/rctl.conf"
+                info "[${TARGET}]: rctl.conf removed."
+            else
+                error_continue "[${TARGET}]: rctl.conf not found."
+            fi
+            ;;
+    esac
 done

usr/local/share/bastille/stop.sh

@@ -129,9 +129,7 @@ for _jail in ${JAILS}; do
 
     # Remove rctl limits
     if [ -s "${bastille_jailsdir}/${_jail}/rctl.conf" ]; then
-        while read _limits; do
+        bastille limits "${_jail}" clear
-            rctl -r "${_limits}"
-        done < "${bastille_jailsdir}/${_jail}/rctl.conf"
     fi
 
     # Stop jail