From 6d777e12ed3009a9d3ebc3124d140ca5226da4cc Mon Sep 17 00:00:00 2001
From: Daniel J Walsh <dwalsh@redhat.com>
Date: Mon, 27 Apr 2020 14:59:27 -0400
Subject: [PATCH] Add Verify function to check if Ulimit max value is too big

When parsing the ulimit, we should check if the ulimit max value is greater then
the processes max value.  If yes then we should return an error.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
---
 ulimit_linux.go       | 18 ++++++++++++++++++
 ulimit_linux_test.go  | 24 ++++++++++++++++++++++++
 ulimit_unsupported.go |  8 ++++++++
 3 files changed, 50 insertions(+)
 create mode 100644 ulimit_linux.go
 create mode 100644 ulimit_linux_test.go
 create mode 100644 ulimit_unsupported.go

diff --git a/ulimit_linux.go b/ulimit_linux.go
new file mode 100644
index 0000000..a56f361
--- /dev/null
+++ b/ulimit_linux.go
@@ -0,0 +1,18 @@
+package units
+
+import (
+	"fmt"
+
+	"golang.org/x/sys/unix"
+)
+
+// Verify that ulimit values work with current kernel
+func (u *Ulimit) Verify() error {
+	var rlimit unix.Rlimit
+	if err := unix.Getrlimit(ulimitNameMapping[u.Name], &rlimit); err == nil {
+		if u.Hard > int64(rlimit.Max) {
+			return fmt.Errorf("ulimit hard limit (%d) must be less than or equal to hard limit for the current process %d", u.Hard, rlimit.Max)
+		}
+	}
+	return nil
+}
diff --git a/ulimit_linux_test.go b/ulimit_linux_test.go
new file mode 100644
index 0000000..1b0ecc3
--- /dev/null
+++ b/ulimit_linux_test.go
@@ -0,0 +1,24 @@
+// +build linux
+
+package units
+
+import (
+	"fmt"
+
+	"golang.org/x/sys/unix"
+	"testing"
+)
+
+func TestParseUlimitTooBig(t *testing.T) {
+	var rlimit unix.Rlimit
+	if err := unix.Getrlimit(rlimitNofile, &rlimit); err != nil {
+		t.Fatalf("Failed to get rlimit of current process %q", err)
+	}
+	u, err := ParseUlimit(fmt.Sprintf("nofile=512:%d", rlimit.Max+1))
+	if err != nil {
+		t.Fatalf("expected valid value got %q", err)
+	}
+	if err := u.Verify(); err == nil {
+		t.Fatalf("expected invalid hard limit")
+	}
+}
diff --git a/ulimit_unsupported.go b/ulimit_unsupported.go
new file mode 100644
index 0000000..8cc60ea
--- /dev/null
+++ b/ulimit_unsupported.go
@@ -0,0 +1,8 @@
+// +build !linux
+
+package units
+
+// Verify that ulimit values work with current kernel
+func (u *Ulimit) Verify() error {
+	return nil
+}