rlimit-util: introduce setrlimit_closest_all()

This new call applies all configured resource limits in one.

diff --git a/src/basic/rlimit-util.c b/src/basic/rlimit-util.c
index 7bae9f0ad0ce3af6c6b3e87b12839488e4468735..dccc4e60e1adaffbc2b0eb1688afac7717168406 100644 (file)
--- a/src/basic/rlimit-util.c
+++ b/src/basic/rlimit-util.c
@@ -42,6 +42,32 @@ int setrlimit_closest(int resource, const struct rlimit *rlim) {
         return 0;
 }
 
+int setrlimit_closest_all(const struct rlimit *const *rlim, int *which_failed) {
+        int i, r;
+
+        assert(rlim);
+
+        /* On failure returns the limit's index that failed in *which_failed, but only if non-NULL */
+
+        for (i = 0; i < _RLIMIT_MAX; i++) {
+                if (!rlim[i])
+                        continue;
+
+                r = setrlimit_closest(i, rlim[i]);
+                if (r < 0) {
+                        if (which_failed)
+                                *which_failed = i;
+
+                        return r;
+                }
+        }
+
+        if (which_failed)
+                *which_failed = -1;
+
+        return 0;
+}
+
 static int rlimit_parse_u64(const char *val, rlim_t *ret) {
         uint64_t u;
         int r;

diff --git a/src/basic/rlimit-util.h b/src/basic/rlimit-util.h
index 067e040c61b2a543c9f68248f2c31107b9a6f1b7..d50fd38c2e2f2de5b0ecbeb4a3296dadd9c48bdf 100644 (file)
--- a/src/basic/rlimit-util.h
+++ b/src/basic/rlimit-util.h
@@ -16,6 +16,7 @@ int rlimit_from_string(const char *s) _pure_;
 int rlimit_from_string_harder(const char *s) _pure_;
 
 int setrlimit_closest(int resource, const struct rlimit *rlim);
+int setrlimit_closest_all(const struct rlimit * const *rlim, int *which_failed);
 
 int rlimit_parse_one(int resource, const char *val, rlim_t *ret);
 int rlimit_parse(int resource, const char *val, struct rlimit *ret);

diff --git a/src/core/execute.c b/src/core/execute.c
index 3349bbaccbf4feb93e4de5e959f123ca03c98a61..9781b7d92007ba401b30e55999a46e22db138dad 100644 (file)
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -2727,7 +2727,7 @@ static int exec_child(
 #endif
         uid_t uid = UID_INVALID;
         gid_t gid = GID_INVALID;
-        int i, r, ngids = 0;
+        int r, ngids = 0;
         size_t n_fds;
         ExecDirectoryType dt;
         int secure_bits;
@@ -3167,17 +3167,12 @@ static int exec_child(
 
         if (needs_sandboxing) {
                 uint64_t bset;
+                int which_failed;
 
-                for (i = 0; i < _RLIMIT_MAX; i++) {
-
-                        if (!context->rlimit[i])
-                                continue;
-
-                        r = setrlimit_closest(i, context->rlimit[i]);
-                        if (r < 0) {
-                                *exit_status = EXIT_LIMITS;
-                                return log_unit_error_errno(unit, r, "Failed to adjust resource limit RLIMIT_%s: %m", rlimit_to_string(i));
-                        }
+                r = setrlimit_closest_all((const struct rlimit* const *) context->rlimit, &which_failed);
+                if (r < 0) {
+                        *exit_status = EXIT_LIMITS;
+                        return log_unit_error_errno(unit, r, "Failed to adjust resource limit RLIMIT_%s: %m", rlimit_to_string(which_failed));
                 }
 
                 /* Set the RTPRIO resource limit to 0, but only if nothing else was explicitly requested. */