secure 1.1.0 → 1.1.1

data/README.md

@@ -39,6 +39,7 @@ Options:
 * :pipe_stdin, :pipe_stdout, :pipe_stderr => A File to pipe the stdin, out ond stderr to
 * :safe => An integer that represents the new safe mode (default 3)
 * :limit_files => Maximum file descriptor the block can open. If you want to say no files, set this to 0
+* :limit_procs => Maximum number of processes that the user can create. Set this to 0 if you want to ensure no one forks
 
 Errors:
 =======
@@ -57,7 +58,7 @@ How Does it work:
 
 Known Issues:
 =============
-* :limit_memory does not work on OSX (at least whatever version I use), but it does work on linux
+* :limit_memory and :limit_procs does not work on OSX (at least whatever version I use), but it does work on linux
 * :pipe_stdout is not tested because of some rspec weirdness
 * A block bound before $SAFE is set sees the old safe value. Refer to this for some clue about the reason why this happens: http://blog.sidu.in/2007/11/ruby-blocks-gotchas.html
 * Stdout cannot be piped to a StringIO. You need to open a unix PIPE. There are two reasons for this. The code runs in a child process, so you need to use and IPC mechanism, and a string IO is not recognized as a file at the C level

data/lib/secure/child_process.rb

@@ -8,12 +8,13 @@ module Secure
       @timeout = opts[:timeout]
       @limit_memory = opts[:limit_memory]
       @limit_cpu = opts[:limit_cpu]
+      @limit_files = opts[:limit_files]
+      @limit_procs = opts[:limit_procs]
       @pipe_stdout = opts[:pipe_stdout]
       @pipe_stderr = opts[:pipe_stderr]
       @pipe_stdin = opts[:pipe_stdin]
       @run_before = opts[:run_before]
       @safe_value = opts[:safe] || 3
-      @limit_files = opts[:limit_files]
     end
 
     def guard_threads
@@ -24,6 +25,7 @@ module Secure
       Process::setrlimit(Process::RLIMIT_AS, @limit_memory) if @limit_memory
       Process::setrlimit(Process::RLIMIT_CPU, @limit_cpu, 2 + @limit_cpu) if @limit_cpu
       Process::setrlimit(Process::RLIMIT_NOFILE, @limit_files, @limit_files) if @limit_files
+      Process::setrlimit(Process::RLIMIT_NPROC, @limit_procs, @limit_procs) if @limit_procs
     end
 
     def redirect_files

data/lib/secure/version.rb

@@ -1,3 +1,3 @@
 module Secure
-  VERSION = "1.1.0"
+  VERSION = "1.1.1"
 end

data/spec/secure/runner_spec.rb

@@ -94,7 +94,9 @@ module Secure
 
       if RUBY_PLATFORM =~ /darwin/
         pending "should kill a process with too much memory (does not work on OSX)"
+        pending "kills a process trying to fork (does not work on OSX)"
       else
+
         it "should kill a process with too much memory on linux" do
           response = Runner.new(:limit_memory => 10 * 1024).run do
             'a' * 10 * 1024
@@ -102,6 +104,17 @@ module Secure
           response.should_not be_success
           response.error.should be_a(NoMemoryError)
         end
+
+        it "kills a process trying to fork" do
+          response = Runner.new(:safe => 0, :limit_procs => 0).run do
+            fork do
+              exit
+            end
+            10
+          end
+          response.should_not be_success
+          response.error.should be_a(ThreadError)
+        end
       end
 
       it "kills a process using too much cpu" do
@@ -120,6 +133,7 @@ module Secure
         response.error.should be_a(Errno::EMFILE)
       end
 
+
       it "should not be able to open a file" do
         response = Runner.new.run do
           File.open("/etc/passwd")

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: secure
 version: !ruby/object:Gem::Version
-  version: 1.1.0
+  version: 1.1.1
   prerelease: 
 platform: ruby
 authors:
@@ -13,7 +13,7 @@ date: 2011-10-26 00:00:00.000000000Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rspec
-  requirement: &70276562098440 !ruby/object:Gem::Requirement
+  requirement: &70151114884720 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -21,10 +21,10 @@ dependencies:
         version: '2.6'
   type: :development
   prerelease: false
-  version_requirements: *70276562098440
+  version_requirements: *70151114884720
 - !ruby/object:Gem::Dependency
   name: rake
-  requirement: &70276562098020 !ruby/object:Gem::Requirement
+  requirement: &70151114884300 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -32,7 +32,7 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70276562098020
+  version_requirements: *70151114884300
 description: see summary
 email:
 - tejas@gja.in