Merge in changes from edx-platform-master branch which specify

the number of processes and threads to allow.

codejail/limits.py

@@ -14,6 +14,8 @@ LIMITS = {
     "VMEM": 0,
     # Size of files creatable, in bytes, defaulting to nothing can be written.
     "FSIZE": 0,
+    # The number of processes and threads to allow.
+    "NPROC": 15,
     # Whether to use a proxy process or not.  None means use an environment
     # variable to decide. NOTE: using a proxy process is NOT THREAD-SAFE, only
     # one thread can use CodeJail at a time if you are using a proxy process.
@@ -43,6 +45,9 @@ def set_limit(limit_name, value):
         * `"FSIZE"`: the maximum size of files creatable by the jailed code,
             in bytes.  The default is 0 (no files may be created).
 
+        * `"NPROC"`: the maximum number of process or threads creatable by the
+            jailed code.  The default is 15.
+
         * `"PROXY"`: 1 to use a proxy process, 0 to not use one. This isn't
             really a limit, sorry about that.
 
@@ -59,8 +64,11 @@ def create_rlimits():
     """
     rlimits = []
 
-    # No subprocesses.
-    rlimits.append((resource.RLIMIT_NPROC, (0, 0)))
+    # Allow a small number of subprocess and threads.  One limit controls both,
+    # and at least OpenBLAS (imported by numpy) requires threads.
+    nproc = LIMITS["NPROC"]
+    if nproc:
+        rlimits.append((resource.RLIMIT_NPROC, (nproc, nproc)))
 
     # CPU seconds, not wall clock time.
     cpu = LIMITS["CPU"]