Method Set

pkg/sentry/limits/limits.go:217–235

Set assigns value v to resource of LimitType t and returns the old value. privileged should be true only when either the caller has CAP_SYS_RESOURCE or when creating limits for a new kernel.

(t LimitType, v Limit, privileged bool)

// privileged should be true only when either the caller has CAP_SYS_RESOURCE
// or when creating limits for a new kernel.
func (l *LimitSet) Set(t LimitType, v Limit, privileged bool) (Limit, error) {
	l.mu.Lock()
	defer l.mu.Unlock()

	// If a limit is already set, make sure the new limit doesn't
	// exceed the previous max limit.
	if _, ok := l.data[t]; ok {
		// Unprivileged users can only lower their hard limits.
		if l.data[t].Max < v.Max && !privileged {
			return Limit{}, unix.EPERM
		}
		if v.Cur > v.Max {
			return Limit{}, unix.EINVAL
		}
	}
	old := l.data[t]
	l.data[t] = v
	return old, nil
}