Function rctl_enforce

freebsd/kern/kern_rctl.c:497–699

* Check whether the proc 'p' can allocate 'amount' of 'resource' in addition * to what it keeps allocated now. Returns non-zero if the allocation should * be denied, 0 otherwise. */

 * be denied, 0 otherwise.
 */
int
rctl_enforce(struct proc *p, int resource, uint64_t amount)
{
	static struct timeval log_lasttime, devctl_lasttime;
	static int log_curtime = 0, devctl_curtime = 0;
	struct rctl_rule *rule;
	struct rctl_rule_link *link;
	struct sbuf sb;
	char *buf;
	int64_t available;
	uint64_t sleep_ms, sleep_ratio;
	int should_deny = 0;

	ASSERT_RACCT_ENABLED();
	RACCT_LOCK_ASSERT();

	/*
	 * There may be more than one matching rule; go through all of them.
	 * Denial should be done last, after logging and sending signals.
	 */
	LIST_FOREACH(link, &p->p_racct->r_rule_links, rrl_next) {
		rule = link->rrl_rule;
		if (rule->rr_resource != resource)
			continue;

		available = rctl_available_resource(p, rule);
		if (available >= (int64_t)amount) {
			link->rrl_exceeded = 0;
			continue;
		}

		switch (rule->rr_action) {
		case RCTL_ACTION_DENY:
			should_deny = 1;
			continue;
		case RCTL_ACTION_LOG:
			/*
			 * If rrl_exceeded != 0, it means we've already
			 * logged a warning for this process.
			 */
			if (link->rrl_exceeded != 0)
				continue;

			/*
			 * If the process state is not fully initialized yet,
			 * we can't access most of the required fields, e.g.
			 * p->p_comm.  This happens when called from fork1().
			 * Ignore this rule for now; it will be processed just
			 * after fork, when called from racct_proc_fork_done().
			 */
			if (p->p_state != PRS_NORMAL)
				continue;

			if (!ppsratecheck(&log_lasttime, &log_curtime,
			    rctl_log_rate_limit))
				continue;

			buf = malloc(RCTL_LOG_BUFSIZE, M_RCTL, M_NOWAIT);