def test_stack_size(self): max_memory = self.memory_limit(resource.RLIMIT_STACK) prlimit = processutils.ProcessLimits(stack_size=max_memory) self.check_limit(prlimit, 'RLIMIT_STACK', max_memory)
from oslo_utils import fileutils from oslo_utils import imageutils from oslo_utils import units import nova.conf from nova import exception from nova.i18n import _ from nova import image from nova import utils LOG = logging.getLogger(__name__) CONF = nova.conf.CONF IMAGE_API = image.API() QEMU_IMG_LIMITS = processutils.ProcessLimits(cpu_time=30, address_space=1 * units.Gi) # This is set by the libvirt driver on startup. The version is used to # determine what flags need to be set on the command line. QEMU_VERSION = None QEMU_VERSION_REQ_SHARED = 2010000 def qemu_img_info(path, format=None): """Return an object containing the parsed output from qemu-img info.""" # TODO(mikal): this code should not be referring to a libvirt specific # flag. if not os.path.exists(path) and CONF.libvirt.images_type != 'rbd': raise exception.DiskNotFound(location=path) try:
def test_number_files(self): nfiles = self.soft_limit(resource.RLIMIT_NOFILE, 1, 1024) prlimit = processutils.ProcessLimits(number_files=nfiles) self.check_limit(prlimit, 'RLIMIT_NOFILE', nfiles)
def test_number_processes(self): nprocs = self.soft_limit(resource.RLIMIT_NPROC, 1, 65535) prlimit = processutils.ProcessLimits(number_processes=nprocs) self.check_limit(prlimit, 'RLIMIT_NPROC', nprocs)
def test_memory_locked(self): max_memory = self.memory_limit(resource.RLIMIT_MEMLOCK) prlimit = processutils.ProcessLimits(memory_locked=max_memory) self.check_limit(prlimit, 'RLIMIT_MEMLOCK', max_memory)
def test_resident_set_size(self): max_memory = self.memory_limit(resource.RLIMIT_RSS) prlimit = processutils.ProcessLimits(resident_set_size=max_memory) self.check_limit(prlimit, 'RLIMIT_RSS', max_memory)
def test_data_size(self): max_memory = self.memory_limit(resource.RLIMIT_DATA) prlimit = processutils.ProcessLimits(data_size=max_memory) self.check_limit(prlimit, 'RLIMIT_DATA', max_memory)
def test_file_size(self): size = self.soft_limit(resource.RLIMIT_FSIZE, 1, 1024) prlimit = processutils.ProcessLimits(file_size=size) self.check_limit(prlimit, 'RLIMIT_FSIZE', prlimit.file_size)
def test_core_size(self): size = self.soft_limit(resource.RLIMIT_CORE, 1, 1024) prlimit = processutils.ProcessLimits(core_file_size=size) self.check_limit(prlimit, 'RLIMIT_CORE', prlimit.core_file_size)
def test_cpu_time(self): time = self.soft_limit(resource.RLIMIT_CPU, 1, 1024) prlimit = processutils.ProcessLimits(cpu_time=time) self.check_limit(prlimit, 'RLIMIT_CPU', prlimit.cpu_time)
def limit_address_space(self): max_memory = self.memory_limit(resource.RLIMIT_AS) return processutils.ProcessLimits(address_space=max_memory)
from oslo_concurrency import processutils as putils from oslo_log import log as logging from oslo_utils import encodeutils from oslo_utils import units from taskflow import task from glance.i18n import _LW LOG = logging.getLogger(__name__) # NOTE(hemanthm): As reported in the bug #1449062, "qemu-img info" calls can # be exploited to craft DoS attacks by providing malicious input. The process # limits defined here are protections against such attacks. This essentially # limits the CPU time and address space used by the process that executes # "qemu-img info" command to 2 seconds and 1 GB respectively. QEMU_IMG_PROC_LIMITS = putils.ProcessLimits(cpu_time=2, address_space=1 * units.Gi) class OptionalTask(task.Task): def __init__(self, *args, **kwargs): super(OptionalTask, self).__init__(*args, **kwargs) self.execute = self._catch_all(self.execute) def _catch_all(self, func): # NOTE(flaper87): Read this comment before calling the MI6 # Here's the thing, there's no nice way to define "optional" # tasks. That is, tasks whose failure shouldn't affect the execution # of the flow. The only current "sane" way to do this, is by catching # everything and logging. This seems harmless from a taskflow # perspective but it is not. There are some issues related to this # "workaround":
default=True, help='When possible, compress images uploaded ' 'to the image service'), cfg.IntOpt('image_conversion_cpu_limit', default=60, help='CPU time limit in seconds to convert the image'), cfg.IntOpt('image_conversion_address_space_limit', default=1, help='Address space limit in gigabytes to convert the image'), ] CONF = cfg.CONF CONF.register_opts(image_opts) QEMU_IMG_LIMITS = processutils.ProcessLimits( cpu_time=CONF.image_conversion_cpu_limit, address_space=CONF.image_conversion_address_space_limit * units.Gi) QEMU_IMG_FORMAT_MAP = { # Convert formats of Glance images to how they are processed with qemu-img. 'iso': 'raw', 'vhd': 'vpc', 'ploop': 'parallels', } QEMU_IMG_FORMAT_MAP_INV = {v: k for k, v in QEMU_IMG_FORMAT_MAP.items()} QEMU_IMG_VERSION = None QEMU_IMG_MIN_FORCE_SHARE_VERSION = [2, 10, 0] QEMU_IMG_MIN_CONVERT_LUKS_VERSION = '2.10' COMPRESSIBLE_IMAGE_FORMATS = ('qcow2', )
CONF = cfg.CONF CONF.register_opts(opts, group='disk_utils') LOG = logging.getLogger(__name__) _PARTED_PRINT_RE = re.compile(r"^(\d+):([\d\.]+)MiB:" "([\d\.]+)MiB:([\d\.]+)MiB:(\w*)::(\w*)") CONFIGDRIVE_LABEL = "config-2" MAX_CONFIG_DRIVE_SIZE_MB = 64 # Maximum disk size supported by MBR is 2TB (2 * 1024 * 1024 MB) MAX_DISK_SIZE_MB_SUPPORTED_BY_MBR = 2097152 # Limit the memory address space to 1 GiB when running qemu-img QEMU_IMG_LIMITS = processutils.ProcessLimits(address_space=1 * units.Gi) def list_partitions(device): """Get partitions information from given device. :param device: The device path. :returns: list of dictionaries (one per partition) with keys: number, start, end, size (in MiB), filesystem, flags """ output = utils.execute( 'parted', '-s', '-m', device, 'unit', 'MiB', 'print', use_standard_locale=True, run_as_root=True)[0] if isinstance(output, bytes): output = output.decode("utf-8") lines = [line for line in output.split('\n') if line.strip()][2:]
from oslo_concurrency import processutils limit = processutils.ProcessLimits(cpu_time=1, memory_locked=512, stack_size=512) try: (out, err) = processutils.execute("pwd", prlimit=limit) print(out, err) except processutils.ProcessExecutionError as e: print(e) #processutils.ssh_execute(<ssh connection object>, cmd ...)