a d Z ddlZddlZddlZddlZddlZddlmZ ddlm Z m
Z
m Z m Z ddl
mZ ej e ZdZdZ eej d d Zd
Zd Zd Zd
Zd Z d Z d Z d Z ddZ d Z!d Z"dS )uX Public command API for isolatectl limits — per-domain (LVD) resource limit management. N) userdomains ) DomainEntry LvdConfig get_usernameresolve_docroot)LvdErrorz(/usr/share/lve-utils/lvd-registry-helperz&/usr/share/lve-utils/lvd-limits-helper PYLVE_DEBUGc ddi| S )Nresultsuccess )kwargss py/websiteisolation/commands.py_okr s i *6 ** c t | } t | pg }n(# t $ r}t d| d| |d}~ww xY wd |D S )zCReturn set of domain names that belong to the user (via panel API).z"failed to query domains for user 'z': Nc h | ]\ }}|S r r ).0name_docroots r z _user_domains..) s - - -^T8D - - -r )r r Exceptionr )lve_idusernamepairsexcs r
_user_domainsr " s F##HYH%%+ Y Y YNHNNNNOOUXXY - -u - - --s #
AAAc N t | }|st d| d |S )zResolve domain -> docroot.z)cannot resolve document root for domain '')r r )domaindocroots r _docroot_forr# , s7 f%%G NL6LLLMMM Nr c Z t j } t rd| d< | S )z/Build environment for SUID helper subprocesses.1LIBLVE_DEBUG_ENABLED)osenvironcopy_DEBUG)envs r _helper_envr, 4 s+
*//
C
*&) "# Jr c T t r t d| t j d S d S )NzDEBUG [lvdctl]: file)r* printsysstderr)msgs r _dbgr4 < s8
9
&&&SZ8888889 9r c t dt | |g}t dt d| d| t j |dddt }n-# t $ r }t dt d | |d
}~ww xY wt d |j d |j
d
|j
|j dk r+|j
}t d| |j
}|sd
S t | S # t $ r}t d| |d
}~ww xY w)zHCall lvd-registry-helper get and return domain_id, or None if not found.getcall z get uid=z docroot=TFcapture_outputtextcheckr+ failed to run : N rc=z stdout= stderr=r z lvd-registry-helper failed: z-lvd-registry-helper returned invalid output: )REGISTRY_HELPERstrr4
subprocessrunr, OSErrorr
returncodestdoutstripr2 int
ValueError)uidr" argvr er2 outr s r _get_domain_lve_idrN A s UCHHg 6D B B B3 B B B BCCCG D
G G G>>>1>>??QFG
."
.
.FM,?,?,A,A
.
.M''))
.
. / / / A $$&&>f>>???
-
C tY3xx Y Y YNsNNOOUXXYs/ %A
B'BB)D8 8
EEEc | dd }|r|dz nd}| dd }|r|dz nd}| dd }| dd }| dd } | dd }
| d d } t t | t | t | t | t | t | t |
t | t | g
} t d
t d | d | d
| d| d| d| d| d|
d| d| d| d t j | dddt
}
n-# t $ r }t dt d| |d}~ww xY wt d |
j d |
j
|
j r)t d |
j |
j dk r+|
j
}t d | dS ) u Call lvd-limits-helper to apply limits to kernel.
Unit conversions (user-facing → kernel):
cpu — centipercent, pass as-is
pmem — bytes → 4 KB pages
io — KB/s, pass as-is
nproc, iops, ep — pass as-is
vmem — bytes → 4 KB pages
pmemr i vmemcpuionprociopsepr7 z uid=z domain_id=z cpu=z pmem=zpages(z
bytes) io=z nproc=z iops=z ep=z vmem=zbytes)TFr8 r< r= Nr> r? z stdout=zlvd-limits-helper failed: )
r6
LIMITS_HELPERrA r4 rB rC r, rD r rE r2 rG rF )rJ domain_idlimits
pmem_bytes
pmem_pages
vmem_bytes
vmem_pagesrR rS rT rU rV rK r rL r2 s r _call_limits_helperr^ ] s FA&&J'18t##qJFA&&J'18t##qJ
**UA
C D! B JJw " "E ::fa D D! B C#i.. C#j//3r77CJJD BZ D
?
?
?S
?
?Y
?
?
?
? &
?
?.8
?
?
?
?
?
?(,
?
?
?
? %
?
? -7
?
?
? @ @ @E D
E E E<
<<<<==1DE E" E EFM,?,?,A,A E EFFF
} 4
2 ,,..
2
2333
A $$&&z cmd_list.. s% :::6)9)91)9)9)9r )r r rY )rj ) r rh r rj r rk rY rl r )r r! rr rq rj r ry s ` r cmd_listr{ s
^F
#
#F & ! !EnG
::::g:::
F
6
F h&&((
v r c t | }||vrt d| d| t j | }t | || S )z/Push one domain's limits from config to kernel.r` ra )r r r rh
_apply_domain)r r! rq rr s r cmd_applyr~ s[ & ! !E
UX&XXPVXXYYY
^F
#
#F 0 00r c | | }|t d| d t | }t | | }|t d| d| d |j } t
j t j d| d| d | n5# t $ r(}t d
| t j Y d}~nd}~ww xY wt | || t || S )
a&
Push one domain's limits from config to kernel via SUID helpers.
Looks up the domain ID that was assigned by the admin via
``lvectl enable-domain-limits``. Domain ID assignment is a
root-only operation; users can only read existing mappings and
apply limits to them.
rd Nr` z&' not found in config; use 'set' firstrb rc zlvdctl apply: lve_id=re z limits=rf r. rg )ri r r# rN rY rl ro rp rD r0 r1 r2 r^ r )r r! rr rs r" rX applied_limitsrL s r r} r} sl
F + +E }P&PPPQQQ6""G"6733I
::: f^ 4 4 44s =(B& &
C0 CC)NN)#__doc__loggingr' rB r1 ro clcommon.cpapir rr r r r r
exceptionsr getLogger__name__logr@ rW rH r( r6 r* r r r# r, r4 rN r^ rv r{ r~ r} r r r r s _ ^
& & & & & & ! g!!<8
RZ^^M1
-
- . .+ + +. . . 9 9 9
Y Y Y8+> +> +>\)1 )1 )1X .1 1 1#5 #5 #5 #5 #5r