You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
117 lines
4.2 KiB
117 lines
4.2 KiB
diff -up sudo-1.8.6p3/src/exec.c.nprocfix sudo-1.8.6p3/src/exec.c |
|
--- sudo-1.8.6p3/src/exec.c.nprocfix 2013-07-11 12:55:10.686308050 +0200 |
|
+++ sudo-1.8.6p3/src/exec.c 2013-07-11 12:54:21.159160553 +0200 |
|
@@ -132,6 +132,15 @@ static int fork_cmnd(struct command_deta |
|
if (policy_init_session(details) != true) |
|
errorx(1, _("policy plugin failed session initialization")); |
|
|
|
+ /* |
|
+ * See the comment in unlimit_nproc. It is important to call |
|
+ * this function AFTER policy_init_session, because the PAM |
|
+ * subsystem, if used, may change the RLIMIT_NPROC limit to |
|
+ * unlimited (infinity) and we would not be able to distinguish |
|
+ * between our temporary change and the change done by PAM. |
|
+ */ |
|
+ unlimit_nproc(); |
|
+ |
|
cmnd_pid = sudo_debug_fork(); |
|
switch (cmnd_pid) { |
|
case -1: |
|
diff -up sudo-1.8.6p3/src/exec_pty.c.nprocfix sudo-1.8.6p3/src/exec_pty.c |
|
--- sudo-1.8.6p3/src/exec_pty.c.nprocfix 2012-09-18 15:57:43.000000000 +0200 |
|
+++ sudo-1.8.6p3/src/exec_pty.c 2013-07-11 12:37:41.811202301 +0200 |
|
@@ -678,6 +678,15 @@ fork_pty(struct command_details *details |
|
errorx(1, _("policy plugin failed session initialization")); |
|
|
|
/* |
|
+ * See the comment in unlimit_nproc. It is important to call |
|
+ * this function AFTER policy_init_session, because the PAM |
|
+ * subsystem, if used, may change the RLIMIT_NPROC limit to |
|
+ * unlimited (infinity) and we would not be able to distinguish |
|
+ * between our temporary change and the change done by PAM. |
|
+ */ |
|
+ unlimit_nproc(); |
|
+ |
|
+ /* |
|
* Block some signals until cmnd_pid is set in the parent to avoid a |
|
* race between exec of the command and receipt of a fatal signal from it. |
|
*/ |
|
diff -up sudo-1.8.6p3/src/sudo.c.nprocfix sudo-1.8.6p3/src/sudo.c |
|
--- sudo-1.8.6p3/src/sudo.c.nprocfix 2013-07-11 12:37:41.767202170 +0200 |
|
+++ sudo-1.8.6p3/src/sudo.c 2013-07-11 12:37:41.811202301 +0200 |
|
@@ -808,25 +808,11 @@ sudo_check_suid(const char *path) |
|
static void |
|
disable_coredumps(void) |
|
{ |
|
-#if defined(__linux__) || defined(RLIMIT_CORE) |
|
- struct rlimit rl; |
|
+#if defined(RLIMIT_CORE) |
|
+ struct rlimit rl; |
|
#endif |
|
debug_decl(disable_coredumps, SUDO_DEBUG_UTIL) |
|
|
|
-#if defined(__linux__) |
|
- /* |
|
- * Unlimit the number of processes since Linux's setuid() will |
|
- * apply resource limits when changing uid and return EAGAIN if |
|
- * nproc would be violated by the uid switch. |
|
- */ |
|
- (void) getrlimit(RLIMIT_NPROC, &nproclimit); |
|
- rl.rlim_cur = rl.rlim_max = RLIM_INFINITY; |
|
- if (setrlimit(RLIMIT_NPROC, &rl)) { |
|
- memcpy(&rl, &nproclimit, sizeof(struct rlimit)); |
|
- rl.rlim_cur = rl.rlim_max; |
|
- (void)setrlimit(RLIMIT_NPROC, &rl); |
|
- } |
|
-#endif /* __linux__ */ |
|
#ifdef RLIMIT_CORE |
|
/* |
|
* Turn off core dumps? |
|
@@ -841,6 +827,28 @@ disable_coredumps(void) |
|
debug_return; |
|
} |
|
|
|
+void |
|
+unlimit_nproc(void) |
|
+{ |
|
+ debug_decl(unlimit_nproc, SUDO_DEBUG_UTIL) |
|
+#if defined(__linux__) |
|
+ struct rlimit rl; |
|
+ /* |
|
+ * Unlimit the number of processes since Linux's setuid() will |
|
+ * apply resource limits when changing uid and return EAGAIN if |
|
+ * nproc would be violated by the uid switch. |
|
+ */ |
|
+ (void) getrlimit(RLIMIT_NPROC, &nproclimit); |
|
+ rl.rlim_cur = rl.rlim_max = RLIM_INFINITY; |
|
+ if (setrlimit(RLIMIT_NPROC, &rl)) { |
|
+ memcpy(&rl, &nproclimit, sizeof(struct rlimit)); |
|
+ rl.rlim_cur = rl.rlim_max; |
|
+ (void)setrlimit(RLIMIT_NPROC, &rl); |
|
+ } |
|
+#endif /* __linux__ */ |
|
+ debug_return; |
|
+} |
|
+ |
|
#ifdef HAVE_PROJECT_H |
|
static void |
|
set_project(struct passwd *pw) |
|
@@ -1082,7 +1090,6 @@ exec_setup(struct command_details *detai |
|
errno = 0; |
|
l = sysconf(_SC_CHILD_MAX); |
|
if (l == -1 && errno == 0 && getrlimit(RLIMIT_NPROC, &rl) == 0) { |
|
- if (rl.rlim_cur == RLIM_INFINITY && rl.rlim_max == RLIM_INFINITY) |
|
(void) setrlimit(RLIMIT_NPROC, &nproclimit); |
|
} |
|
} |
|
diff -up sudo-1.8.6p3/src/sudo.h.nprocfix sudo-1.8.6p3/src/sudo.h |
|
--- sudo-1.8.6p3/src/sudo.h.nprocfix 2013-07-11 12:37:41.768202173 +0200 |
|
+++ sudo-1.8.6p3/src/sudo.h 2013-07-11 12:37:41.811202301 +0200 |
|
@@ -219,6 +219,7 @@ int policy_init_session(struct command_d |
|
int run_command(struct command_details *details); |
|
extern const char *list_user, *runas_user, *runas_group; |
|
extern struct user_details user_details; |
|
+void unlimit_nproc(void); |
|
|
|
/* sudo_edit.c */ |
|
int sudo_edit(struct command_details *details);
|
|
|