65 lines
2.8 KiB
Diff
65 lines
2.8 KiB
Diff
From e35327017659a1bf07d68448ce896b96a4ae30f5 Mon Sep 17 00:00:00 2001
|
|
From: Lennart Poettering <lennart@poettering.net>
|
|
Date: Thu, 17 Jan 2019 12:24:14 +0100
|
|
Subject: [PATCH] execute: make sure to call into PAM after initializing
|
|
resource limits
|
|
|
|
We want that pam_limits takes precedence over our settings, after all.
|
|
|
|
Fixes: #11386
|
|
(cherry picked from commit ce932d2d331886190dca9d54571d3d99d9fe8cfc)
|
|
|
|
Resolves: RHEL-5986
|
|
---
|
|
src/core/execute.c | 28 ++++++++++++++++++++--------
|
|
1 file changed, 20 insertions(+), 8 deletions(-)
|
|
|
|
diff --git a/src/core/execute.c b/src/core/execute.c
|
|
index 7e186c948c..ad9f660540 100644
|
|
--- a/src/core/execute.c
|
|
+++ b/src/core/execute.c
|
|
@@ -3291,7 +3291,24 @@ static int exec_child(
|
|
#endif
|
|
}
|
|
|
|
+ if (needs_sandboxing) {
|
|
+ int which_failed;
|
|
+
|
|
+ /* Let's set the resource limits before we call into PAM, so that pam_limits wins over what
|
|
+ * is set here. (See below.) */
|
|
+
|
|
+ r = setrlimit_closest_all((const struct rlimit* const *) context->rlimit, &which_failed);
|
|
+ if (r < 0) {
|
|
+ *exit_status = EXIT_LIMITS;
|
|
+ return log_unit_error_errno(unit, r, "Failed to adjust resource limit RLIMIT_%s: %m", rlimit_to_string(which_failed));
|
|
+ }
|
|
+ }
|
|
+
|
|
if (needs_setuid) {
|
|
+
|
|
+ /* Let's call into PAM after we set up our own idea of resource limits to that pam_limits
|
|
+ * wins here. (See above.) */
|
|
+
|
|
if (context->pam_name && username) {
|
|
r = setup_pam(context->pam_name, username, uid, gid, context->tty_path, &accum_env, fds, n_fds);
|
|
if (r < 0) {
|
|
@@ -3413,15 +3430,10 @@ static int exec_child(
|
|
|
|
if (needs_sandboxing) {
|
|
uint64_t bset;
|
|
- int which_failed;
|
|
-
|
|
- r = setrlimit_closest_all((const struct rlimit* const *) context->rlimit, &which_failed);
|
|
- if (r < 0) {
|
|
- *exit_status = EXIT_LIMITS;
|
|
- return log_unit_error_errno(unit, r, "Failed to adjust resource limit RLIMIT_%s: %m", rlimit_to_string(which_failed));
|
|
- }
|
|
|
|
- /* Set the RTPRIO resource limit to 0, but only if nothing else was explicitly requested. */
|
|
+ /* Set the RTPRIO resource limit to 0, but only if nothing else was explicitly
|
|
+ * requested. (Note this is placed after the general resource limit initialization, see
|
|
+ * above, in order to take precedence.) */
|
|
if (context->restrict_realtime && !context->rlimit[RLIMIT_RTPRIO]) {
|
|
if (setrlimit(RLIMIT_RTPRIO, &RLIMIT_MAKE_CONST(0)) < 0) {
|
|
*exit_status = EXIT_LIMITS;
|