4

We allow users to execute scripts on our servers. Our security model involves chrooting them. We want to be able to apply ulimit restrictions to them, and the best way to do it would seem to be in /etc/security/limits.conf

But, it doesn't seem to work. Here's what we set in limits.conf:

@registered_users    -    priority   7
@registered_users    -    nice       7
*                    -    priority   9
*                    -    nice       9

And it works in some cases:

sudo -u testuser python

Will give a python process with niceness 9 (not 7, annoyingly)

BUT

sudo chroot --userspec=testuser:registered_users python

gives a python process with niceness 0.

any clues?

We've tried adding session required pam_limits.so to /etc/pam.d/common-session, to no avail.

3
  • 1
    Have you tried copying limits.conf into the chroot jail?
    – haimg
    Jan 23, 2012 at 19:45
  • yeah.. we've also tried to kick off processes with "bash -l -c python", instead of just "python", to try and invoke the pam/login process, to no avail...
    – hwjp
    Jan 24, 2012 at 9:36
  • 1
    You can try running strace on your command, with and without the chroot, and checking what the difference is, e.g. diff the two outputs.
    – haimg
    Jan 24, 2012 at 14:22

1 Answer 1

1

The settings in /etc/security/limits.conf are not working inside the chroot because there is no program using pam_limits to set them. They work when you use sudo, because sudo's PAM configuration does call pam_limits.

The obvious answer is to call something inside the chroot that uses pam_limits, like "su", as they say here: https://lists.debian.org/debian-user/2010/09/msg01398.html (though you have to uncomment the line that uses pam_limits in /etc/pam.d/su, because it comes commented by default).

I.e., assuming your chroot directory is /srv/chroot, and you want to execute /usr/bin/python, you could try something like this:

sudo chroot /srv/chroot su testuser /usr/bin/python

I think sudo will do the trick, too:

sudo chroot /srv/chroot sudo -u testuser /usr/bin/python

But I can only speak for "su", which is what I use in a case like this. Please, try it and tell if it worked for you.

1
  • ... is the correct answer. we had actually managed to figure it out, but had forgotten to update this question. Thanks for following up!
    – hwjp
    Dec 7, 2014 at 15:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .