From owner-freebsd-rc@FreeBSD.ORG Tue Apr 30 00:10:49 2013 Return-Path: Delivered-To: freebsd-rc@freebsd.org Received: from mx1.freebsd.org (mx1.FreeBSD.org [8.8.178.115]) by hub.freebsd.org (Postfix) with ESMTP id AA7F7D36; Tue, 30 Apr 2013 00:10:49 +0000 (UTC) (envelope-from gjb@FreeBSD.org) Received: from onyx.glenbarber.us (onyx.glenbarber.us [IPv6:2607:fc50:1000:c200::face]) by mx1.freebsd.org (Postfix) with ESMTP id 82B891F89; Tue, 30 Apr 2013 00:10:49 +0000 (UTC) Received: from glenbarber.us (kaos.glenbarber.us [71.224.221.174]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) (Authenticated sender: gjb) by onyx.glenbarber.us (Postfix) with ESMTPSA id 7ACAB23F804; Mon, 29 Apr 2013 20:10:44 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.8.2 onyx.glenbarber.us 7ACAB23F804 Authentication-Results: onyx.glenbarber.us; dkim=none reason="no signature"; dkim-adsp=none Date: Mon, 29 Apr 2013 20:10:43 -0400 From: Glen Barber To: Raphael Eiselstein Subject: Re: How to set resource limits (ulimit) per service with /etc/rc.subr and /etc/rc.conf Message-ID: <20130430001043.GB1588@glenbarber.us> References: <20130429233344.GA4769@ma.sigsys.de> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="jq0ap7NbKX2Kqbes" Content-Disposition: inline In-Reply-To: <20130429233344.GA4769@ma.sigsys.de> X-Operating-System: FreeBSD 10.0-CURRENT amd64 User-Agent: Mutt/1.5.21 (2010-09-15) Cc: freebsd-rc@freebsd.org X-BeenThere: freebsd-rc@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Discussion related to /etc/rc.d design and implementation." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Apr 2013 00:10:49 -0000 --jq0ap7NbKX2Kqbes Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Tue, Apr 30, 2013 at 01:33:44AM +0200, Raphael Eiselstein wrote: > Hi everyone, >=20 > we have some generic parameters for rc-scripts like=20 > ${name}_program ${name}_chroot ${name}_flags ${name}_nice ${name}_user > any many more. >=20 > I'm looking for a way to configure different ulimits per service. It > seems we have nothing about "ulimit" somewhere in /etc. >=20 > I'd like to have a unique way to configure resource limits, hard and > soft limits. >=20 > Resource limits can be set within a script for the current process by=20 > "ulimit [-HSabcdflmnpstuvw] [limit]" but not as a parameterised wrapper > like "nice" or "chroot" or "su", so prepeding just another "ulimit" > wrapper seems not to be an option. >=20 > Is there a unique way to have resource limits per service? I didn't find > any. AFAICS we have two options handling this: >=20 > #1 writing a /bin/sh wrapper prepeding ${_doit} containing ulimit > commands >=20 > #2 having (someone) to build up a generic binary like nice(1) getting > limit-parameters by commandline before execve'ing the final command, e.g.= =20 >=20 > limitsh -Hv 20480 -Sv 10240 -n 300 -c command args >=20 > Problem: shells shoud implement "-c command args" and ulimit uses -c for > coredumpsize in 512byte blocks. To get around this: -Hc and -Sc are=20 > hard/soft limits to corefilesize, a single "-c" is always the > command-string like in sh(1)=20 >=20 > Any ideas? Did I miss something? >=20 You might be able to do this by using the ${name}_program rc(8) variable. For example (untested): syslogd_program=3D"/usr/bin/ulimit [ulimit_args] /usr/sbin/syslogd" syslogd_flags=3D"[...]" Glen --jq0ap7NbKX2Kqbes Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (FreeBSD) iQEcBAEBCAAGBQJRfwwDAAoJEFJPDDeguUajKsEH/31TSJMwo8tXIVLc7tJyTqIP 7nu312SfwY/OHxnL+ienXFGmRcJmZjxQaFMrq+4JaJUDuHRlS3wJbENY3ivoB+YM iLWt0ote0kN/kh0tZM0tYMoXCKwkEZjakbhwPt/46zRuvRwO0UJwbvBBprSBgXvQ 26FIUqtrMBoXg8UKRYgyah7tR8o/lICG5VF10T4s8V4gj5uacC7vAY5ewHIXlXln 9rYyFZZ6HztYBSyxrsgiXirHpvHVahijw5fj4lPWi16oysvi7n87g00eNRk3KDLn jZkk3iriD7uqfI6+qu5oUUm7FTUfqhLcMjqot8LyRjvbLsjmjPgxgpe3mJXyTiQ= =zd1z -----END PGP SIGNATURE----- --jq0ap7NbKX2Kqbes--