Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 22 Jan 2019 09:46:10 +0000
From:      bugzilla-noreply@freebsd.org
To:        bugs@FreeBSD.org
Subject:   [Bug 235122] rc.subr limits call breaks non-root usage
Message-ID:  <bug-235122-227@https.bugs.freebsd.org/bugzilla/>

next in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D235122

            Bug ID: 235122
           Summary: rc.subr limits call breaks non-root usage
           Product: Base System
           Version: 11.2-RELEASE
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: conf
          Assignee: bugs@FreeBSD.org
          Reporter: freebsd-bugs@virtualtec.ch

We sometimes want customers to be able to restart services (like ldap)=20
running on non-standard and non-privileged ports. With the new unconditiona=
l=20
call to "limits" in the rc.subr start function, this fails:

$ sh /usr/local/etc/rc.d/slapd start
Starting slapd.
limits: setrlimit datasize: Operation not permitted

I suggest a change like the following:

--- /etc/rc.subr.orig   2019-01-22 10:40:13.973245000 +0100
+++ /etc/rc.subr        2019-01-22 09:51:18.058288000 +0100
@@ -1073,7 +1073,9 @@
                        fi

                                        # Prepend default limits
-                       _doit=3D"$_cd limits -C $_login_class $_doit"
+                       if [ `/usr/bin/id -u` -eq 0 ]; then
+                               _doit=3D"$_cd limits -C $_login_class $_doi=
t"
+                       fi

                                        # run the full command
                                        #

and the same service can now be maintained by a non privileged user:

$ sh /usr/local/etc/rc.d/slapd start
Starting slapd.

Kind regards,
Markus

--=20
You are receiving this mail because:
You are the assignee for the bug.=



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-235122-227>