use syscallz::{Context, Action};

pub fn setsyscalls() -> Result<(), Errcode> {
    log::debug!("Refusing / Filtering unwanted syscalls");

    // Unconditionnal syscall deny

    // Conditionnal syscall deny

    // Initialize seccomp profile with all syscalls allowed by default
    if let Ok(mut ctx) = Context::init_with_action(Action::Allow) {

        // Configure profile here

        if let Err(_) = ctx.load(){
            return Err(Errcode::SyscallsError(0));
        }

        Ok(())
    } else {
        Err(Errcode::SyscallsError(1))
    }
}

// ...
mod syscalls;

pub enum Errcode {
    // ...
    SyscallsError(u8),
}

use crate::syscalls::setsyscalls;

pub fn setup_container_configurations(config: &ContainerOpts) -> Result<(), Errcode> {
    // ...
    setsyscalls()?;
    Ok(())
}

const EPERM: u16 = 1;

fn refuse_syscall(ctx: &mut Context, sc: &Syscall) -> Result<(), Errcode>{
    match ctx.set_action_for_syscall(Action::Errno(EPERM), *sc){
        Ok(_) => Ok(()),
        Err(_) => Err(Errcode::SyscallsError(2)),
    }
}

use crate::syscallz::Syscall;

pub fn setsyscalls() -> Result<(), Errcode> {
    // ...
    // Unconditionnal syscall deny
    let syscalls_refused = [
        Syscall::keyctl,
        Syscall::add_key,
        Syscall::request_key,
        Syscall::mbind,
        Syscall::migrate_pages,
        Syscall::move_pages,
        Syscall::set_mempolicy,
        Syscall::userfaultfd,
        Syscall::perf_event_open,
    ];

    if let Ok(mut ctx) = Context::init_with_action(Action::Allow){
        // ...

        for sc in syscalls_refused.iter() {
            refuse_syscall(&mut ctx, sc)?;
        }

        // ...
    }
}

use syscallz::{Comparator, Cmp};

fn refuse_if_comp(ctx: &mut Context, ind: u32, sc: &Syscall, biteq: u64)-> Result<(), Errcode>{
    match ctx.set_rule_for_syscall(Action::Errno(EPERM), *sc,
            &[Comparator::new(ind, Cmp::MaskedEq, biteq, Some(biteq))]){
        Ok(_) => Ok(()),
        Err(_) => Err(Errcode::SyscallsError(3)),
    }
}

use libc::TIOCSTI;
use nix::sys::stat::Mode;
use nix::sched::CloneFlags;

pub fn setsyscalls() -> Result<(), Errcode> {
    // ...

    let s_isuid: u64 = Mode::S_ISUID.bits().into();
    let s_isgid: u64 = Mode::S_ISGID.bits().into();
    let clone_new_user: u64 = CloneFlags::CLONE_NEWUSER.bits() as u64;

    // Conditionnal syscall deny
    let syscalls_refuse_ifcomp = [
        (Syscall::chmod, 1, s_isuid),
        (Syscall::chmod, 1, s_isgid),

        (Syscall::fchmod, 1, s_isuid),
        (Syscall::fchmod, 1, s_isgid),

        (Syscall::fchmodat, 2, s_isuid),
        (Syscall::fchmodat, 2, s_isgid),

        (Syscall::unshare, 0, clone_new_user),
        (Syscall::clone, 0, clone_new_user),

        (Syscall::ioctl, 1, TIOCSTI),
    ];

    if let Ok(mut ctx) = Context::init_with_action(Action::Allow){
        // ...
        for (sc, ind, biteq) in syscalls_refuse_ifcomp.iter(){
            refuse_if_comp(&mut ctx, *ind, sc, *biteq)?;
        }
        // ...
    }
}

RLIMIT_CPU         // CPU time limit given in seconds                                                   
                   // 最大允许的CPU使用时间，秒为单位。
RLIMIT_FSIZE       // the maximum size of files that a process may create                               
                   // 进程可建立的文件的最大长度。
RLIMIT_DATA        // the maximum size of the process's data segment                                    
                   // 进程数据段的最大值。
RLIMIT_STACK       // the maximum size of the process stack in bytes                                    
                   // 最大的进程堆栈，以字节为单位
RLIMIT_CORE        // the maximum size of a core file.
                   // 内核转存文件的最大长度。
RLIMIT_RSS         // the number of bytes that can be allocated for a process in RAM
                   // 进程驻留内存的页数的大小限制
RLIMIT_NPROC       // the maximum number of processes that can be created by a user
                   // 当前进程所属的真实id对应的用户所能创建的最大进程数
RLIMIT_NOFILE      // the maximum number of a file descriptor that can be opened by a process
                   // 一个进程能打开文件个数的最大值
RLIMIT_MEMLOCK     // the maximum number of bytes of memory that may be locked into RAM by mlock.
                   // 进程可锁定在内存中的最大数据量，字节为单位。
RLIMIT_AS          // the maximum size of virtual memory in bytes.
                   // 进程的最大虚内存空间，字节为单位。
RLIMIT_LOCKS       // the maximum number flock and locking related fcntl calls
                   // 进程可建立的文件锁数量最大值。
RLIMIT_SIGPENDING  // maximum number of signals that may be queued for a user of the calling process
                   // 表示进程信号等待队列最大大小
RLIMIT_MSGQUE      // the number of bytes that can be allocated for POSIX message queues
                   // 进程可为POSIX消息队列分配的最大字节数
RLIMIT_NICE        // the maximum nice value that can be set by a process
                   // 进程可通过setpriority() 或 nice()调用设置的最大完美值。
RLIMIT_RTPRIO      // maximum real-time priority value
                   // 进程可通过sched_setscheduler 和 sched_setparam设置的最大实时优先级。
RLIMIT_RTTIME      // maximum number of microseconds that a process may be scheduled under real-time scheduling policy without making blocking system call
                   // 实时进程timer最大超时时间

use rlimit::{setrlimit, Resource};
use cgroups_rs::cgroup_builder::CgroupBuilder;

//                       KiB    MiB    Gib
const KMEM_LIMIT: i64 = 1024 * 1024 * 1024;
const MEM_LIMIT: i64 = KMEM_LIMIT;
const MAX_PID: MaxValue = MaxValue::Value(64);
const NOFILE_RLIMIT: u64 = 64;

pub fn restrict_resources(hostname: &String) -> Result<(), Errcode>{
    log::debug!("Restricting resources for hostname {}", hostname);

    // Cgroups
    let cgs = CgroupBuilder::new(hostname)

        // Allocate less CPU time than other processes
        .cpu().shares(256).done()

        // Limiting the memory usage to 1 GiB
        // The user can limit it to less than this, never increase above 1Gib
        .memory().kernel_memory_limit(KMEM_LIMIT).memory_hard_limit(MEM_LIMIT).done()

        // This process can only create a maximum of 64 child processes
        .pid().maximum_number_of_processes(MAX_PID).done()

        // Give an access priority to block IO lower than the system
        .blkio().weight(50).done()

        .build(Box::new(V2::new()));

    // We apply the cgroups rules to the child process we just created
    let pid : u64 = pid.as_raw().try_into().unwrap();
    if let Err(_) = cgs.add_task(CgroupPid::from(pid)) {
        return Err(Errcode::ResourcesError(0));
    };


    // Rlimit
    // Can create only 64 file descriptors
    if let Err(_) = setrlimit(Resource::NOFILE, NOFILE_RLIMIT, NOFILE_RLIMIT){
        return Err(Errcode::ResourcesError(0));
    }

    Ok(())
}

use crate::resources::restrict_resources;

impl Container {
    // ...

    pub fn create(&mut self) -> Result<(), Errcode> {
        let pid = generate_child_process(self.config.clone())?;
        restrict_resources(&self.config.hostname, pid)?;
        // ...
    }
}

// ...
mod resources;

pub enum Errcode {
    // ...
    ResourcesError(u8),
}

pub fn clean_cgroups(hostname: &String) -> Result<(), Errcode>{
    log::debug!("Cleaning cgroups");
    match canonicalize(format!("/sys/fs/cgroup/{}/", hostname)){
        Ok(d) => {
            if let Err(_) = remove_dir(d) {
                return Err(Errcode::ResourcesError(2));
            }
        },
        Err(e) => {
            log::error!("Error while canonicalize path: {}", e);
            return Err(Errcode::ResourcesError(3));
        }
    }
    Ok(())
}

use crate::resources::clean_cgroups;

impl Container {
    // ...

    pub fn clean_exit(&mut self) -> Result<(), Errcode> {
        // ...

        if let Err(e) = clean_cgroups(&self.config.hostname){
            log::error!("Cgroups cleaning failed: {}", e);
            return Err(e);
        }

        Ok(())
    }
}