carlos / platform Public

Download this file

1	//go:build linux
2
3	package console
4
5	import "syscall"
6
7	// limitVerifierMemory caps the verifier child's private writable memory
8	// (RLIMIT_DATA, which Linux applies to anonymous mappings since 4.7) so a
9	// tiny database declaring a 16-million-entry map dies in the child, not by
10	// exhausting the console's cgroup (code review R10-1). The database file's
11	// own read-only mapping does not count against it.
12	func limitVerifierMemory(bytes uint64) error {
13	return syscall.Setrlimit(syscall.RLIMIT_DATA, &syscall.Rlimit{Cur: bytes, Max: bytes})
14	}
15