On Tue, Apr 05, 2011 at 11:15:47AM +0400, Dmitry V. Levin wrote:
I'm not quite sure that it must _always_ drop rlimits
inheritance.
While the feature looks useful, I think it have to be configurable via
some on/off switch.
Okay, seems fair. I still think it should default to enabled since most
(but not all) applications using PAM are fully delegating these kinds of
things. If you have pam_limits in your stack, you expect it to do its work.
What would you like to see? I haven't done pam config variables before...
-Kees
--
Kees Cook
Ubuntu Security Team