picnoir/Systemd
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

execute: make sure to call into PAM after initializing resource limits

Browse source 
We want that pam_limits takes precedence over our settings, after all.

Fixes: #11386
This commit is contained in:
Lennart Poettering 2019-01-17 12:24:14 +01:00
parent 498e265df1
commit ce932d2d33
1 changed files with 20 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
src/core/execute.c
View file

@ -3226,7 +3226,24 @@ static int exec_child(
#endif
}
if (needs_sandboxing) {
int which_failed;
/* Let's set the resource limits before we call into PAM, so that pam_limits wins over what
* is set here. (See below.) */
r = setrlimit_closest_all((const struct rlimit* const *) context->rlimit, &which_failed);
if (r < 0) {
*exit_status = EXIT_LIMITS;
return log_unit_error_errno(unit, r, "Failed to adjust resource limit RLIMIT_%s: %m", rlimit_to_string(which_failed));
}
}
if (needs_setuid) {
/* Let's call into PAM after we set up our own idea of resource limits to that pam_limits
* wins here. (See above.) */
if (context->pam_name && username) {
r = setup_pam(context->pam_name, username, uid, gid, context->tty_path, &accum_env, fds, n_fds);
if (r < 0) {
@ -3343,15 +3360,10 @@ static int exec_child(
if (needs_sandboxing) {
uint64_t bset;
int which_failed;
r = setrlimit_closest_all((const struct rlimit* const *) context->rlimit, &which_failed);
if (r < 0) {
*exit_status = EXIT_LIMITS;
return log_unit_error_errno(unit, r, "Failed to adjust resource limit RLIMIT_%s: %m", rlimit_to_string(which_failed));
}
/* Set the RTPRIO resource limit to 0, but only if nothing else was explicitly requested. */
/* Set the RTPRIO resource limit to 0, but only if nothing else was explicitly
* requested. (Note this is placed after the general resource limit initialization, see
* above, in order to take precedence.) */
if (context->restrict_realtime && !context->rlimit[RLIMIT_RTPRIO]) {
if (setrlimit(RLIMIT_RTPRIO, &RLIMIT_MAKE_CONST(0)) < 0) {
*exit_status = EXIT_LIMITS;