diff --git a/usr/local/share/bastille/limits.sh b/usr/local/share/bastille/limits.sh new file mode 100755 index 00000000..ead18788 --- /dev/null +++ b/usr/local/share/bastille/limits.sh @@ -0,0 +1,74 @@ +#!/bin/sh +# +# Copyright (c) 2018-2019, Christer Edwards +# All rights reserved. +# Ressource limits added by Sven R github.com/hackacad +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are met: +# +# * Redistributions of source code must retain the above copyright notice, this +# list of conditions and the following disclaimer. +# +# * Redistributions in binary form must reproduce the above copyright notice, +# this list of conditions and the following disclaimer in the documentation +# and/or other materials provided with the distribution. +# +# * Neither the name of the copyright holder nor the names of its +# contributors may be used to endorse or promote products derived from +# this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" +# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE +# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER +# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, +# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +. /usr/local/share/bastille/colors.pre.sh + +usage() { + echo -e "${COLOR_RED}Usage: bastille limits TARGET option value${COLOR_RESET}" + echo -e "Example: bastille limits JAILNAME memoryuse 1G" + exit 1 +} + +RACCT_ENABLE=$(sysctl -n kern.racct.enable) +if [ "${RACCT_ENABLE}" != '1' ]; then + echo "Racct not enabled. Append 'kern.racct.enable=1' to /boot/loader.conf and reboot" +fi + +# Handle special-case commands first. +case "$1" in +help|-h|--help) + usage + ;; +esac + +if [ $# -lt 2 ]; then + usage +fi + +TARGET="${1}" +OPTION="${2}" +VALUE="${3}" +shift + +if [ "${TARGET}" = 'ALL' ]; then + JAILS=$(jls name) +fi + +if [ "${TARGET}" != 'ALL' ]; then + JAILS=$(jls name | grep -w "${TARGET}") +fi + +for _jail in ${JAILS}; do + echo -e "${COLOR_GREEN}[${_jail}]:${COLOR_RESET}" + echo -e "${TYPE} ${VALUE}" + rctl -a jail:${_jail}:${OPTION}:deny=${VALUE}/jail + echo -e "${COLOR_RESET}" +done