On Tue, Apr 05, 2011 at 10:28:47AM +0200, Thorsten Kukuk wrote:
On Mon, Apr 04, Kees Cook wrote:
> The primary reason for doing this is that when PAM runs, it may not have a
> sensible set of default rlimits, so it should always start over from the
> kernel-defined defaults.
That would be a wrong behavior of pam_limits. If an application sets
limits and then forks, pam_limits shouldn't reset that values.
I think that if pam_limits is in the stack, this makes sense, but I'm happy
to add a toggle for it.
I have to admit that I still don't understand the problem.
But we use a package "ulimits" to set global, usefull limits
during boot time. Afterwards the init scripts/processes can
overwrite them for their needs.
How do you deal with the kernel's dynamic setting of nproc?
-Kees
--
Kees Cook
Ubuntu Security Team