We allow users to execute scripts on our servers. Our security model involves chrooting them. We want to be able to apply ulimit restrictions to them, and the best way to do it would seem to be in /etc/security/limits.conf
But, it doesn't seem to work. Here's what we set in limits.conf
:
@registered_users - priority 7
@registered_users - nice 7
* - priority 9
* - nice 9
And it works in some cases:
sudo -u testuser python
Will give a python process with niceness 9 (not 7, annoyingly)
BUT
sudo chroot --userspec=testuser:registered_users python
gives a python process with niceness 0.
any clues?
We've tried adding session required pam_limits.so
to /etc/pam.d/common-session
, to no avail.
strace
on your command, with and without the chroot, and checking what the difference is, e.g. diff the two outputs.