search

bsdci / libioc

A Python library to manage jails with ioc{age,ell}
https://bsd.ci/libioc
Other
38 stars 11 forks source link

Jail with multiple resource limits cannot be started #699

Closed urosgruber closed 5 years ago

urosgruber commented 5 years ago

Looks like that df0ad67df1f63450c01f3bccffdad73c5f569fa1 broke ioc create. I get error like this

[-] JailStart@ioc/ancient-step-0E4WGX: ...
  [+] JailDependantsStart@ioc/ancient-step-0E4WGX: No dependant jails [0.0s]
  [+] JailResolverConfig@ioc/ancient-step-0E4WGX: OK [0.001s]
  [-] JailResourceLimitAction@ioc/ancient-step-0E4WGX: ...
  [-] JailResourceLimitAction@ioc/ancient-step-0E4WGX: FAILED [0.005s]
l
    rctl: malformed rule '-a': missing subject
    rctl: malformed rule '-a': missing subject
Command exited with 2

So looks like something around rctl inside Jail.py It's still broken on latest master

I'll add this as well, that creating simple jail without any resource limits IP address is not set when jail is started. Not sure if config changed but last working version is e903f88d4eeb6211771ae62f819024eba8ab66ff

gronke commented 5 years ago

@urosgruber Are there any resource limits configured for this Jail? Could you post the resource limit config properties, so that I can reproduce the issue?

urosgruber commented 5 years ago

@gronke this is my config

{
    "basejail": "yes",
    "basejail_type": "nullfs",
    "boot": "yes",
    "exec_poststart": "/root/tools/hooks/poststart.sh",
    "exec_prestop": "/root/tools/hooks/prestop.sh",
    "hostid": "00d9391a-5ada-e711-aed2-a4bf01175004",
    "id": "ancient-step-pqWbLb",
    "ip4_addr": "lo1|172.16.1.6/32",
    "memoryuse": "512M:deny",
    "pcpu": "20:deny",
    "release": "11.2-RELEASE",
    "tags": "boxr,production,www,php,api",
    "user": {
        "account": "26c67740-5071-11e9-99a8-a4bf01175004",
        "image": "php71-template-v2"
    },
    "vmemoryuse": "1024M:deny"
}r
gronke commented 5 years ago

Thank you! I was able to reproduce the issue:

$ python3.6 . create rlimit-test pcpu=20 memoryuse=512M vmemoryuse=1024M
rlimit-test successfully created from 12.0-RELEASE!
$ python3.6 . start rlimit-test
[-] JailStart@rlimit-test: ...
  [+] JailDependantsStart@rlimit-test: No dependant jails [0.0s]
  [+] JailResolverConfig@rlimit-test: OK [0.001s]
  [-] JailResourceLimitAction@rlimit-test: ...
  [-] JailResourceLimitAction@rlimit-test: FAILED [0.012s]
t-test:pcpu:deny=20/jail
    rctl: malformed rule '-a': missing subject
    rctl: malformed rule '-a': missing subject
Command exited with 2