increase_rlimits() tries to set RLIMIT_CORE high, which grsec disallows #1421

New Issue

zooko · 2011-06-17T04:46:57Z

zooko commented

2011-06-17 04:46:57 +00:00

Originally reported in #982 by ioerror:

Grsec disallows a resource overstep when tahoe requests 4196256 for RLIMIT_CORE. To get tahoe started, you'll need to add the following to the init.d script:

ulimit -c 4196256

But, when I read [the source code of increase_rlimits()]source:trunk/src/allmydata/util/iputil.py?annotate=blame&rev=4971#L12 I don't see any evidence that we deliberately set RLIMIT_CORE. (We certainly never intended to.)

So, is it that calling resource.getrlimit(resource.RLIMIT_NOFILE) is also setting RLIMIT_CORE? Perhaps this is a bug in the Python standard library. Could someone with grsecurity installed please reproduce this issue and show the complete error message?

Originally reported in #982 by ioerror: Grsec disallows a resource overstep when tahoe requests 4196256 for `RLIMIT_CORE`. To get tahoe started, you'll need to add the following to the init.d script: ``` ulimit -c 4196256 ``` But, when I read [the source code of increase_rlimits()]source:trunk/src/allmydata/util/iputil.py?annotate=blame&rev=4971#L12 I don't see any evidence that we deliberately set `RLIMIT_CORE`. (We certainly never intended to.) So, is it that calling `resource.getrlimit(resource.RLIMIT_NOFILE)` is also setting `RLIMIT_CORE`? Perhaps this is a bug in the Python standard library. Could someone with grsecurity installed please reproduce this issue and show the complete error message?

zooko added the

labels 2011-06-17 04:46:57 +00:00

zooko added this to the undecided milestone 2011-06-17 04:46:57 +00:00

zooko commented

2011-06-17 11:45:32 +00:00

I posted to the grsec mailing list asking about this: http://grsecurity.net/pipermail/grsecurity/2011-June/001083.html

I posted to the grsec mailing list asking about this: <http://grsecurity.net/pipermail/grsecurity/2011-June/001083.html>

zooko commented

2011-06-20 05:15:03 +00:00

Brad Spengler posted to the grsec mailing list that it was probably due to the other issue (#982) that the process was attempting to dump core, and that the RLIMIT_CORE is probably set to that value by default, so closing this as not-an-issue.

Brad Spengler [posted to the grsec mailing list](http://grsecurity.net/pipermail/grsecurity/2011-June/001084.html) that it was probably due to the other issue (#982) that the process was attempting to dump core, and that the `RLIMIT_CORE` is probably set to that value by default, so closing this as not-an-issue.

zooko added the

invalid

label 2011-06-20 05:15:03 +00:00

zooko closed this issue

2011-06-20 05:15:03 +00:00

Sign in to join this conversation.