From patchwork Tue Jan 26 13:47:09 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Paolo Bonzini X-Patchwork-Id: 8122881 Return-Path: X-Original-To: patchwork-qemu-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 2E5E6BEEE5 for ; Tue, 26 Jan 2016 14:06:42 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id AD03B2025B for ; Tue, 26 Jan 2016 14:06:36 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 3351120256 for ; Tue, 26 Jan 2016 14:06:32 +0000 (UTC) Received: from localhost ([::1]:44093 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aO4GN-0003dY-HO for patchwork-qemu-devel@patchwork.kernel.org; Tue, 26 Jan 2016 09:06:31 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:35401) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aO3yp-0000sz-PE for qemu-devel@nongnu.org; Tue, 26 Jan 2016 08:48:24 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aO3yo-0004Dj-TE for qemu-devel@nongnu.org; Tue, 26 Jan 2016 08:48:23 -0500 Received: from mx1.redhat.com ([209.132.183.28]:32818) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aO3yo-0004De-Nu for qemu-devel@nongnu.org; Tue, 26 Jan 2016 08:48:22 -0500 Received: from int-mx10.intmail.prod.int.phx2.redhat.com (int-mx10.intmail.prod.int.phx2.redhat.com [10.5.11.23]) by mx1.redhat.com (Postfix) with ESMTPS id 58A5219F99B; Tue, 26 Jan 2016 13:48:22 +0000 (UTC) Received: from 640k.localdomain.com (ovpn-112-67.ams2.redhat.com [10.36.112.67]) by int-mx10.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id u0QDlNqm028272; Tue, 26 Jan 2016 08:48:21 -0500 From: Paolo Bonzini To: qemu-devel@nongnu.org Date: Tue, 26 Jan 2016 14:47:09 +0100 Message-Id: <1453816041-36362-38-git-send-email-pbonzini@redhat.com> In-Reply-To: <1453816041-36362-1-git-send-email-pbonzini@redhat.com> References: <1453816041-36362-1-git-send-email-pbonzini@redhat.com> X-Scanned-By: MIMEDefang 2.68 on 10.5.11.23 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 209.132.183.28 Cc: Janosch Frank Subject: [Qemu-devel] [PULL 37/49] scripts/kvm/kvm_stat: Fix rlimit for unprivileged users X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Janosch Frank Setting the hard limit as a unprivileged user either returns an error when it is higher than the current one or irreversibly sets it lower. Therefore we leave the hardlimit untouched as long as we don't need to raise it as this needs CAP_SYS_RESOURCE. This gives admins the possibility to run the script as an unprivileged user to increase security. Signed-off-by: Janosch Frank Message-Id: <1452525484-32309-32-git-send-email-frankja@linux.vnet.ibm.com> Signed-off-by: Paolo Bonzini --- scripts/kvm/kvm_stat | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/scripts/kvm/kvm_stat b/scripts/kvm/kvm_stat index 611f82a..2a1842e 100755 --- a/scripts/kvm/kvm_stat +++ b/scripts/kvm/kvm_stat @@ -434,11 +434,19 @@ class TracepointProvider(object): # The constant is needed as a buffer for python libs, std # streams and other files that the script opens. - rlimit = len(cpus) * len(self._fields) + 50 + newlim = len(cpus) * len(self._fields) + 50 try: - resource.setrlimit(resource.RLIMIT_NOFILE, (rlimit, rlimit)) + softlim_, hardlim = resource.getrlimit(resource.RLIMIT_NOFILE) + + if hardlim < newlim: + # Now we need CAP_SYS_RESOURCE, to increase the hard limit. + resource.setrlimit(resource.RLIMIT_NOFILE, (newlim, newlim)) + else: + # Raising the soft limit is sufficient. + resource.setrlimit(resource.RLIMIT_NOFILE, (newlim, hardlim)) + except ValueError: - sys.exit("NOFILE rlimit could not be raised to {0}".format(rlimit)) + sys.exit("NOFILE rlimit could not be raised to {0}".format(newlim)) for cpu in cpus: group = Group()