Add resource controls and lifecycle tests

Author: dannote

lib/systemd/transient_unit.ex

@@ -31,6 +31,24 @@ defmodule Systemd.TransientUnit do
   @spec uint64(String.t(), non_neg_integer()) :: Property.t()
   def uint64(name, value), do: property(name, "t", value)
 
+  @doc """
+  Creates a memory limit property such as `MemoryMax`.
+  """
+  @spec memory_max(non_neg_integer()) :: Property.t()
+  def memory_max(bytes), do: uint64("MemoryMax", bytes)
+
+  @doc """
+  Creates a task-count limit property such as `TasksMax`.
+  """
+  @spec tasks_max(non_neg_integer()) :: Property.t()
+  def tasks_max(tasks), do: uint64("TasksMax", tasks)
+
+  @doc """
+  Creates a CPU quota property in microseconds per second.
+  """
+  @spec cpu_quota_per_sec_usec(non_neg_integer()) :: Property.t()
+  def cpu_quota_per_sec_usec(usec), do: uint64("CPUQuotaPerSecUSec", usec)
+
   @doc """
   Creates an `ExecStart` property.
   """

lib/systemd/unit_file/validator.ex

@@ -29,7 +29,7 @@ defmodule Systemd.UnitFile.Validator do
       ),
     "Service" =>
       MapSet.new(
-        ~w(Type ExecStart ExecStartPre ExecStartPost ExecCondition ExecReload ExecStop ExecStopPost Restart RestartSec User Group WorkingDirectory RootDirectory Environment EnvironmentFile PassEnvironment UnsetEnvironment TimeoutStartSec TimeoutStopSec TimeoutAbortSec KillSignal KillMode RemainAfterExit GuessMainPID PIDFile RuntimeDirectory RuntimeDirectoryPreserve StateDirectory CacheDirectory LogsDirectory ConfigurationDirectory StandardOutput StandardError SyslogIdentifier LimitNOFILE LimitNPROC LimitMEMLOCK LimitCORE LimitCPU LimitAS LimitFSIZE NoNewPrivileges PrivateTmp PrivateDevices ProtectSystem ProtectHome AmbientCapabilities CapabilityBoundingSet ReadWritePaths ReadOnlyPaths InaccessiblePaths OOMPolicy)
+        ~w(Type ExecStart ExecStartPre ExecStartPost ExecCondition ExecReload ExecStop ExecStopPost Restart RestartSec User Group WorkingDirectory RootDirectory Environment EnvironmentFile PassEnvironment UnsetEnvironment TimeoutStartSec TimeoutStopSec TimeoutAbortSec KillSignal KillMode RemainAfterExit GuessMainPID PIDFile RuntimeDirectory RuntimeDirectoryPreserve StateDirectory CacheDirectory LogsDirectory ConfigurationDirectory StandardOutput StandardError SyslogIdentifier Slice Delegate CPUAccounting CPUWeight CPUQuota MemoryAccounting MemoryMin MemoryLow MemoryHigh MemoryMax MemorySwapMax TasksAccounting TasksMax IOAccounting IOWeight IPAccounting LimitNOFILE LimitNPROC LimitMEMLOCK LimitCORE LimitCPU LimitAS LimitFSIZE NoNewPrivileges PrivateTmp PrivateDevices ProtectSystem ProtectHome AmbientCapabilities CapabilityBoundingSet ReadWritePaths ReadOnlyPaths InaccessiblePaths OOMPolicy)
       ),
     "Install" => MapSet.new(~w(WantedBy RequiredBy Also Alias DefaultInstance)),
     "Socket" =>
@@ -223,13 +223,39 @@ defmodule Systemd.UnitFile.Validator do
        when directive in [
               "RemainAfterExit",
               "GuessMainPID",
+              "Delegate",
+              "CPUAccounting",
+              "MemoryAccounting",
+              "TasksAccounting",
+              "IOAccounting",
+              "IPAccounting",
               "NoNewPrivileges",
               "PrivateTmp",
               "PrivateDevices"
             ] do
     boolean("Service", directive, value, span)
   end
 
+  defp value_errors("Service", directive, value, span)
+       when directive in [
+              "MemoryMin",
+              "MemoryLow",
+              "MemoryHigh",
+              "MemoryMax",
+              "MemorySwapMax",
+              "TasksMax"
+            ] do
+    resource_limit("Service", directive, value, span)
+  end
+
+  defp value_errors("Service", directive, value, span)
+       when directive in ["CPUWeight", "IOWeight"] do
+    positive_integer("Service", directive, value, span)
+  end
+
+  defp value_errors("Service", "CPUQuota", value, span),
+    do: percentage("Service", "CPUQuota", value, span)
+
   defp value_errors("Service", "KillMode", value, span) do
     one_of("Service", "KillMode", value, ~w(control-group mixed process none), span)
   end
@@ -367,6 +393,40 @@ defmodule Systemd.UnitFile.Validator do
     end
   end
 
+  defp resource_limit(_section, _directive, "infinity", _span), do: []
+
+  defp resource_limit(section, directive, value, span) do
+    if ValueParser.resource_quantity?(value) do
+      []
+    else
+      [
+        value_error(
+          section,
+          directive,
+          value,
+          "expected bytes, K/M/G/T/P/E suffix, or infinity",
+          span
+        )
+      ]
+    end
+  end
+
+  defp positive_integer(section, directive, value, span) do
+    if ValueParser.positive_integer?(value) do
+      []
+    else
+      [value_error(section, directive, value, "expected a positive integer", span)]
+    end
+  end
+
+  defp percentage(section, directive, value, span) do
+    if ValueParser.percentage?(value) do
+      []
+    else
+      [value_error(section, directive, value, "expected a percentage such as 50%", span)]
+    end
+  end
+
   defp octal_mode(section, directive, value, span) do
     if ValueParser.octal_mode?(value) do
       []

lib/systemd/unit_file/value_parser.ex

@@ -31,9 +31,19 @@ defmodule Systemd.UnitFile.ValueParser do
     ])
     |> eos()
 
+  resource_unit = choice(Enum.map(~w(K M G T P E), &string/1))
+  resource_quantity = digits |> optional(resource_unit) |> eos()
+
+  positive_integer =
+    ascii_string([?1..?9], min: 1) |> concat(repeat(ascii_string([?0..?9], 1))) |> eos()
+
+  percentage = decimal |> ignore(string("%")) |> eos()
   octal_mode = ascii_string([?0..?7], min: 3, max: 4) |> eos()
 
   defparsecp(:parse_duration_value, duration)
+  defparsecp(:parse_resource_quantity_value, resource_quantity)
+  defparsecp(:parse_positive_integer_value, positive_integer)
+  defparsecp(:parse_percentage_value, percentage)
   defparsecp(:parse_octal_mode_value, octal_mode)
 
   @doc false
@@ -42,6 +52,24 @@ defmodule Systemd.UnitFile.ValueParser do
     parse_duration_value(value) |> parse_ok?()
   end
 
+  @doc false
+  @spec resource_quantity?(String.t()) :: boolean()
+  def resource_quantity?(value) when is_binary(value) do
+    parse_resource_quantity_value(value) |> parse_ok?()
+  end
+
+  @doc false
+  @spec positive_integer?(String.t()) :: boolean()
+  def positive_integer?(value) when is_binary(value) do
+    parse_positive_integer_value(value) |> parse_ok?()
+  end
+
+  @doc false
+  @spec percentage?(String.t()) :: boolean()
+  def percentage?(value) when is_binary(value) do
+    parse_percentage_value(value) |> parse_ok?()
+  end
+
   @doc false
   @spec octal_mode?(String.t()) :: boolean()
   def octal_mode?(value) when is_binary(value) do

test/systemd/manager_integration_test.exs

@@ -6,6 +6,7 @@ defmodule Systemd.ManagerIntegrationTest do
     Job,
     JobStatus,
     Manager,
+    Properties,
     TransientUnit,
     Unit,
     UnitFileOperation,
@@ -96,6 +97,40 @@ defmodule Systemd.ManagerIntegrationTest do
     end
   end
 
+  test "starts a transient unit with resource controls" do
+    assert {:ok, conn} = Manager.connect()
+
+    name = "systemd-elixir-resource-test-#{System.unique_integer([:positive])}.service"
+
+    properties = [
+      TransientUnit.string("Description", "systemd Elixir resource integration test"),
+      TransientUnit.string("Type", "oneshot"),
+      TransientUnit.boolean("RemainAfterExit", true),
+      TransientUnit.memory_max(67_108_864),
+      TransientUnit.tasks_max(64),
+      TransientUnit.exec_start("/bin/true", ["/bin/true"])
+    ]
+
+    case Manager.start_transient_unit(conn, name, properties) do
+      {:ok, %Job{} = job} ->
+        assert :ok = Job.await(conn, job, timeout: 5_000)
+        assert {:ok, unit} = Manager.get_unit(conn, name)
+
+        assert {:ok, 67_108_864} =
+                 Properties.get(
+                   conn,
+                   unit.object_path,
+                   "org.freedesktop.systemd1.Service",
+                   "MemoryMax"
+                 )
+
+        assert :ok = Manager.stop_unit(conn, name) |> await_or_ok(conn)
+
+      {:error, %Error{} = error} ->
+        assert Error.permission?(error)
+    end
+  end
+
   test "starts and awaits a harmless transient unit" do
     assert {:ok, conn} = Manager.connect()
 
@@ -117,6 +152,9 @@ defmodule Systemd.ManagerIntegrationTest do
     end
   end
 
+  defp await_or_ok({:ok, %Job{} = job}, conn), do: Job.await(conn, job, timeout: 5_000)
+  defp await_or_ok({:error, %Error{} = error}, _conn), do: {:error, error}
+
   defp assert_operation_or_permission({:ok, %UnitFileOperation{changes: changes}})
        when is_list(changes), do: :ok
 

test/systemd/transient_unit_test.exs

@@ -14,6 +14,20 @@ defmodule Systemd.TransientUnitTest do
            ]
   end
 
+  test "builds resource-control properties" do
+    assert Property.to_dbus(TransientUnit.memory_max(67_108_864)) == [
+             "MemoryMax",
+             {"t", 67_108_864}
+           ]
+
+    assert Property.to_dbus(TransientUnit.tasks_max(64)) == ["TasksMax", {"t", 64}]
+
+    assert Property.to_dbus(TransientUnit.cpu_quota_per_sec_usec(500_000)) == [
+             "CPUQuotaPerSecUSec",
+             {"t", 500_000}
+           ]
+  end
+
   test "builds typed auxiliary units" do
     aux = AuxUnit.new("helper.service", [TransientUnit.string("Description", "helper")])
 

test/systemd/unit_file_test.exs

@@ -159,6 +159,33 @@ defmodule Systemd.UnitFileTest do
              "[Service]\nPIDFile=/run/app.pid\nSyslogIdentifier=app\nLimitNOFILE=1048576\nLimitMEMLOCK=infinity\nOOMPolicy=stop\n"
   end
 
+  test "validates common cgroup and resource-control directives" do
+    assert :ok =
+             UnitFile.parse!(
+               "[Service]\nExecStart=/bin/true\nCPUAccounting=yes\nCPUWeight=100\nCPUQuota=50%\nMemoryAccounting=true\nMemoryMax=256M\nMemorySwapMax=infinity\nTasksMax=64\nIOAccounting=on\nIOWeight=200\nDelegate=no\n"
+             )
+             |> UnitFile.validate(:service)
+
+    assert {:error, errors} =
+             UnitFile.parse!(
+               "[Service]\nExecStart=/bin/true\nCPUAccounting=maybe\nCPUWeight=heavy\nCPUQuota=half\nMemoryMax=lots\nTasksMax=many\n"
+             )
+             |> UnitFile.validate(:service)
+
+    for directive <- ["CPUAccounting", "CPUWeight", "CPUQuota", "MemoryMax", "TasksMax"] do
+      assert Enum.any?(
+               errors,
+               &match?(
+                 %Systemd.UnitFile.ValidationError{
+                   reason: :invalid_directive_value,
+                   directive: ^directive
+                 },
+                 &1
+               )
+             )
+    end
+  end
+
   test "validates unit file sections and directives" do
     assert :ok =
              UnitFile.parse!("[Service]\nExecStart=/bin/true\nLimitNOFILE=1048576\n")