@jI d Z ddlZddlZddlZddlZddlZddlZddlmZ ddl m
Z
m Z m Z m
Z
mZmZ ddlmZmZ ej e ZdZdZd Zej ej ej ej ej d
Z d Z d Z d
Z!ddddddddZ" e#ej$ % dd Z&d Z'd Z(d Z)d Z*d Z+d Z,d Z-d Z.d Z/d(d Z0d! Z1d" Z2d)d$Z3d% Z4d& Z5d' Z6dS )*uX Public command API for isolatectl limits — per-domain (LVD) resource limit management. N) userdomains ) PAGE_SIZE DomainEntry LvdConfig config_path get_usernameresolve_docroot) ErrorCodeLvdErrorz(/usr/share/lve-utils/lvd-registry-helperz&/usr/share/lve-utils/lvd-limits-helperz%/usr/share/lve-utils/lvd-stats-helper) c t j | }t | d|j t |j t j
S )zELvdError for a helper that exited non-zero, coded by its exit status.z failed: code) ospathbasenamer stderrstripHELPER_EXIT_CODESget
returncoder BACKEND_UNAVAILABLE)helperresultnames py/websiteisolation/commands.py
_helper_errorr" ) sj
7 F # #D 11&---//11
"
"6#4i6S
T
T V V V V ))usagea)peakm)limitsl))cpuCPU)epEP)vmemVMem)pmemPMem)nprocNproc)ioIO)iopsIOPSCPUfEPfVMemFPMemFNprocFIOfIOPSf)r* r, r. r0 r2 r4 r6 PYLVE_DEBUGc ddi| S )Nr success )kwargss r! _okrD Z s i *6 **r# c t | } t | pg }n4# t $ r'}t d| d| t j |d}~ww xY wd |D S )zCReturn set of domain names that belong to the user (via panel API).z"failed to query domains for user 'z': r Nc h | ]\ }}|S rB rB ).0r _docroots r! z _user_domains..f s - - -^T8D - - -r# )r r Exceptionr r r )lve_idusernamepairsexcs r!
_user_domainsrO ^ s F##HDH%%+ D D DNHNNNN % 9; ; ;@C DD . -u - - --s #
A"AAc t j | }|j r,t dt | dt
j |S )a Load the account's config, refusing to act on one that could not be read.
A config that could not be read is EMPTY, so without this every command
would answer as though the account simply had no per-domain limits: `list`
reports none, `apply` reports a configured domain as never configured, and
`set` persists that emptiness over the file (CLOS-7494). One wrong answer
is a wrong diagnosis, the other loses the records -- neither is worth
giving when the real state is "this file needs attention".
z cannot read z; it may hold limits that this command would otherwise ignore or discard. See ~/.lve/isolatectl.log for what is wrong with it, then repair or remove the filer )r load
unreadabler r r CONFIG_UNREADABLE)rK configs r! _load_configrU i sg ^F
#
#F
B
;v..
&/%@ B B B B
Mr# c f t | }|s t d| dt j |S )zResolve domain -> docroot.z)cannot resolve document root for domain ''r )r
r r r )domaindocroots r! _docroot_forrZ } sG f%%G ;L6LLL % 9; ; ; ; Nr# c Z t j } t rd| d< | S )z/Build environment for SUID helper subprocesses.1LIBLVE_DEBUG_ENABLED)r environcopy_DEBUG)envs r! _helper_envrb s+
*//
C
*&) "# Jr# c T t r t d| t j d S d S )NzDEBUG [lvdctl]: file)r` printsysr )msgs r! _dbgri s8
9
&&&SZ8888889 9r# c t dt | |g}t dt d| d| t j |dddt }n9# t $ r,}t dt d | t j
|d }~ww xY wt d |j
d
|j d|j
|j
dk rt t | |j }|sd S t | S # t $ r}t d| |d }~ww xY w)zHCall lvd-registry-helper get and return domain_id, or None if not found.r call z get uid=z docroot=TFcapture_outputtextcheckra failed to run : r N rc=z stdout= stderr=r z-lvd-registry-helper returned invalid output: )REGISTRY_HELPERstrri
subprocessrunrb OSErrorr r r r stdoutr r r" int
ValueError)uidrY argvr eoutrN s r! _get_domain_lve_idr s UCHHg 6D B B B3 B B B BCCCB D
B B B>>>1>> % 9; ; ;@A BB
."
.
.FM,?,?,A,A
.
.M''))
.
. / / / A OV444
-
C tY3xx Y Y YNsNNOOUXXYs/ %A
B''BB D. .
E8E Ec | dd }|r
|t z nd}| dd }|r
|t z nd}| dd }| dd }| dd } | dd }
| dd } t t | t | t | t | t | t | t |
t | t | g
} t d t d
| d | d | d
| d| d| d| d|
d| d| d| d t j | dddt }
n9# t $ r,}t dt d| t j |d}~ww xY wt d |
j d |
j
|
j r)t d |
j |
j dk rt! t |
dS ) u Call lvd-limits-helper to apply limits to kernel.
Unit conversions (user-facing → kernel):
cpu — centipercent, pass as-is
pmem — bytes → 4 KB pages
io — KB/s, pass as-is
nproc, iops, ep — pass as-is
vmem — bytes → 4 KB pages
r0 r r. r* r4 r2 r6 r, rk z uid=z domain_id=z cpu=z pmem=zpages(z
bytes) io=z nproc=z iops=z ep=z vmem=zbytes)TFrl rp rq r Nrr rs z stdout=)r r
LIMITS_HELPERru ri rv rw rb rx r r r r r r ry r" )r| domain_idr(
pmem_bytes
pmem_pages
vmem_bytes
vmem_pagesr* r4 r2 r6 r, r} r r~ s r! _call_limits_helperr s FA&&J,6=y((AJFA&&J,6=y((AJ
**UA
C D! B JJw " "E ::fa D D! B C#i.. C#j//3r77CJJD BZ D
?
?
?S
?
?Y
?
?
?
? &
?
?.8
?
?
?
?
?
?(,
?
?
?
? %
?
? -7
?
?
? @ @ @B D
B B B<
<<<< % 9; ; ;@A BB E" E EFM,?,?,A,A E EFFF
} 4
2 ,,..
2
2333
A M6222 s 7%F
G''GGc @ t | }||vr!t d| d| t j t | }t | | }|"t d| d| dt j t | }| | }|*t | }|j
| |j
} |j j di | |j
} t | || | ny# t t" f$ re |rF t | || nN# t $ r&}
t$ d||
Y d}
~
n#d}
~
ww xY wt$ d | w xY w t) j t( j d
| d | d | d
| n5# t" $ r(} t- d| t. j Y d} ~ nd} ~ ww xY wt3 || S )z;Store per-domain limits in config and apply them to kernel.domain '&' does not belong to user with lve_id r N^' has no registered domain ID; the server administrator must run 'lvectl enable-domain-limits ' firstr z*cannot restore previous limits of '%s': %szd'%s' keeps the limits just applied until the next lvectl apply: its configuration could not be savedzlvdctl set: lve_id= domain=z old_limits=z new_limits= lvdctl audit-log syslog failed: rd rX r( rB )rO r r DOMAIN_NOT_OWNEDrZ r NOT_ISOLATEDrU find_domainr domainsappendr( to_dictupdater saverx logwarningsyslogLOG_INFOrf rg r rD ) rK rX r( ownedrY r rT entry
old_limits
new_limitsrN r~ s r! cmd_setr s & ! !E
UX&XXPVXX % 68 8 8 8 6""G"6733I
z cmd_list..- s% :::6)9)91)9)9)9r# )r rK owner_uidr( )r ) rU rO r r r _domain_lve_id_or_noner( r rD )rK rX rT r r r r s ` r! cmd_listr s &
!
!F & ! !EnG
::::g:::
F
6
F,VQV<< h&&((
v r# c t d| g}t dt d| t j |dddt }n9# t
$ r,}t
dt d| t j |d
}~ww xY wt d |j d |j
|j d
k rO|j
p|j }t
|pdt j t j |j S # t j t f$ rC}t
d|j d
d t j |d
}~ww xY w)zRun lvd-stats-helper and return lveinfo's parsed JSON.
The helper takes no uid: it reads `getuid()` itself, so there is no
parameter here through which another tenant's figures could be requested.
r rk z get period=TFrl rp rq r Nrr rs r z&lvd-stats-helper failed with no outputz3lvd-stats-helper returned output that is not JSON: ) STATS_HELPERri rv rw rb rx r r r r r r ry jsonloadsJSONDecodeErrorr{ )periodr} r r~ r rN s r! _call_stats_helperr ; s
% (D 3 3 36 3 3444B D
B B B; ;;;; % 9; ; ;@A BB E" E EFM,?,?,A,A E EFFF
A $$&&?&-*=*=*?*?vI!I % 9; ; ; ;z&-((( * -
/}""$$TcT*
/
/.
s/ %A
B'A==BD* *F >E>>Fc d d d d}t D ] \ } fdt D ||< fdt D |d< |S )zFReshape one lveinfo per-domain row into the isolatectl response shape.rX r
parent_uid)r rK r c J i | ] \ }}| | S rB r )rG keycolumnprefixrows r!
z'_domain_stats_entry..h sF
V
F,F,,--
r# c B i | ]\ }}| | S rB r )rG r r r s r! r z'_domain_stats_entry..l s6 !,fSWWV__ r# faults)r _STAT_GROUPS
_STAT_METRICS_FAULT_COLUMNSitems)r r groupr s ` @r! _domain_stats_entryr ` s !!''+&&WW\**
E
&
v
,
e 0>0D0D0F0F E(O Lr# 10mc l t | }| d pg }t | }g }|D ]f}| d }|||vr |t d| ;|||k rD| t
| gt | |dd| S )u Per-domain usage for the calling user's own isolated domains.
Read-only, and scoped three times over: the helper refuses to report on any
uid but its caller's, `lveinfo --id` scopes in SQL, and the names are
intersected with what the panel still attributes to this user — so a
catalogue row for a domain that has since moved cannot surface here.
``domain`` filters the result rather than being passed down. `lveinfo
--domain` resolves a name across the whole host and switches to per-bucket
series output; since `--id` has already narrowed the rows to this user,
filtering here is both simpler and incapable of looking at anyone else.
An empty ``domains`` list is an ordinary answer, not an error: only domains
active during the window are recorded at all, so a quiet site is absent
rather than reported as zero. ``scope`` says so, so a caller can tell "quiet"
from "no data".
datarX Nz7skipping '%s': the panel does not list it for this userz2only domains active during the window are recorded)r r note)scoper )r r rO r r r r rD ) rK rX r payloadrowsr entriesr r s r! cmd_statsr r s $ !((G ;;v $"D & ! !EG
1
1wwx <4u,, M
$&.. *3//0000 H
r# c t | }||vr!t d| d| t j t | }t | || S )z/Push one domain's limits from config to kernel.r r r )rO r r r rU
_apply_domain)rK rX r rT s r! cmd_applyr sl & ! !E
UX&XXPVXX % 68 8 8 8 &
!
!F 0 00r# c t | }t | | }n4# t $ r'}t d|| Y d}~dS d}~ww xY w| t d|| |S )u
Resolve the per-domain LVE ID for one domain, or None when unavailable.
Listing is a read-only report over every domain in the config, so a
single unresolvable domain must not abort the whole listing: a docroot
the panel no longer resolves, or a domain the administrator never
registered with 'lvectl enable-domain-limits', degrades to None and is
logged. The write paths (set/apply) keep raising instead — there the
missing ID means the operation cannot be carried out.
z)cannot resolve domain LVE ID for '%s': %sNzdomain '%s' has no registered domain LVE ID; 'lvectl enable-domain-limits %s' was never run, or the registry was reset while the stored limits survived)rZ r r r r )rK rX rY r rN s r! r r s v&&&vw77 ?MMMttttt (
9:@& J J J s "
A AAc * | | }| t d| dt j t | }t | | }|"t d| d| dt j |j } t j t j
d| d | d
| n5# t $ r(}t d | t j Y d}~nd}~ww xY wt | || t! ||
S )a&
Push one domain's limits from config to kernel via SUID helpers.
Looks up the domain ID that was assigned by the admin via
``lvectl enable-domain-limits``. Domain ID assignment is a
root-only operation; users can only read existing mappings and
apply limits to them.
r Nr z&' not found in config; use 'set' firstr r r zlvdctl apply: lve_id=r z limits=r rd r )r r r
INVALID_VALUErZ r r r( r r r rx rf rg r r rD )rK rX rT r rY r applied_limitsr~ s r! r r s
F + +E }P&PPP % 35 5 5 5 6""G"6733I
::: f^ 4 4 44s (B> >
C0 C++C0)NN)NNr )7__doc__r loggingr rv rg r clcommon.cpapir rT r r r r r r
exceptionsr r getLogger__name__r rt r r r NOT_ALLOWEDr r KERNEL_ERRORr r" r r r rz r^ r r` rD rO rU rZ rb ri r r r r r r r r r r rB r# r! r s _ ^
& & & & & & , + + + + + + +g!!<8
6 $ V V V"
RZ^^M1
-
- . .+ + +. . . ( 9 9 9
Y Y Y8+3 +3 +3\>1 >1 >1B :" " "J $- - - -`1 1 1* * *Z%5 %5 %5 %5 %5r#