PAM 1.6 breaks limits.conf parsing
Howdy, Arch community! Today Ardour warned me that I had a ulimit enforced for locked memory, and indeed I was surprised to find that `ulimit -l` reported 8192 for my user (which I configured to `unlimited` a long time ago). After a bit of investigation, it turned out that this is a bug introduced by PAM 1.6, which fails to read my limits.conf file due to the extra whitespace separating entries: ``` @audio - memlock unlimited ``` This makes pam_limits.so fail with the following: ``` pam_limits(login:session): wrong limit value ' unlimited' for limit type '-' ``` Looks like this issue was introduced with [1], and indeed I can confirm that it's fixed by [2] which references the first commit. Is there any chance we can get a 1.6.0-5 update with this patch in? This version is already in core, and it's a very subtle issue which is likely to be unnoticed by many but come with a lot of (possibly security-relevant) side effects. [1] https://github.com/linux-pam/linux-pam/commit/eec4358a49dc0d6d699532965f453f... [2] https://github.com/linux-pam/linux-pam/commit/9228077d762fc94ebc8d9fb4edfe9b... Thanks! -- Simone
That explains a lot, thanks for digging into this. I've had pw constantly run into ulimits and failed to find out why. Martin On Thu, Mar 14, 2024, 21:19 Simone Baratta <conte91@gmail.com> wrote:
Howdy, Arch community!
Today Ardour warned me that I had a ulimit enforced for locked memory, and indeed I was surprised to find that `ulimit -l` reported 8192 for my user (which I configured to `unlimited` a long time ago). After a bit of investigation, it turned out that this is a bug introduced by PAM 1.6, which fails to read my limits.conf file due to the extra whitespace separating entries:
``` @audio - memlock unlimited ```
This makes pam_limits.so fail with the following: ``` pam_limits(login:session): wrong limit value ' unlimited' for limit type '-' ```
Looks like this issue was introduced with [1], and indeed I can confirm that it's fixed by [2] which references the first commit.
Is there any chance we can get a 1.6.0-5 update with this patch in? This version is already in core, and it's a very subtle issue which is likely to be unnoticed by many but come with a lot of (possibly security-relevant) side effects.
[1] https://github.com/linux-pam/linux-pam/commit/eec4358a49dc0d6d699532965f453f... [2] https://github.com/linux-pam/linux-pam/commit/9228077d762fc94ebc8d9fb4edfe9b...
Thanks!
-- Simone
This is now released with pam 1.6.1 and shipped in Arch Linux. Pretty sure it caused my issue here - https://gitlab.freedesktop.org/pipewire/pipewire/-/issues/3532 Will see how a rebooted system behaves now. Martin On Fri, Mar 15, 2024 at 12:09 AM Martin Rys <spleefer90@gmail.com> wrote:
That explains a lot, thanks for digging into this.
I've had pw constantly run into ulimits and failed to find out why.
Martin
On Thu, Mar 14, 2024, 21:19 Simone Baratta <conte91@gmail.com> wrote:
Howdy, Arch community!
Today Ardour warned me that I had a ulimit enforced for locked memory, and indeed I was surprised to find that `ulimit -l` reported 8192 for my user (which I configured to `unlimited` a long time ago). After a bit of investigation, it turned out that this is a bug introduced by PAM 1.6, which fails to read my limits.conf file due to the extra whitespace separating entries:
``` @audio - memlock unlimited ```
This makes pam_limits.so fail with the following: ``` pam_limits(login:session): wrong limit value ' unlimited' for limit type '-' ```
Looks like this issue was introduced with [1], and indeed I can confirm that it's fixed by [2] which references the first commit.
Is there any chance we can get a 1.6.0-5 update with this patch in? This version is already in core, and it's a very subtle issue which is likely to be unnoticed by many but come with a lot of (possibly security-relevant) side effects.
[1] https://github.com/linux-pam/linux-pam/commit/eec4358a49dc0d6d699532965f453f... [2] https://github.com/linux-pam/linux-pam/commit/9228077d762fc94ebc8d9fb4edfe9b...
Thanks!
-- Simone
participants (2)
-
Martin Rys
-
Simone Baratta