all messages for Guix-related lists mirrored at yhetil.org
 help / color / mirror / code / Atom feed
* [RFC] Support for pam_limits.so: “su” is ignored.
@ 2016-04-01  7:01 Ricardo Wurmus
  2016-04-01 11:00 ` Ludovic Courtès
  0 siblings, 1 reply; 11+ messages in thread
From: Ricardo Wurmus @ 2016-04-01  7:01 UTC (permalink / raw)
  To: guix-devel

[-- Attachment #1: Type: text/plain, Size: 1254 bytes --]

Hi Guix,

attached is a draft patch to make “su”, “login”, and “slim” respect a
limits file via pam_limits.so.  This seems to work, but I found two
things that are a little odd:

* the pam-extension procedure appears to be called more than once on the
  same pam-service.  I added a “(format #t ...)” statement to print the
  name of the pam-service that was passed to the procedure and the same
  name appeared multiple times.  The order of these multiple executions
  appears random, so we can have three times “su”, followed by one time
  “login”, then two times “su” again, etc.  I thought service folding
  ensured that each service extension is evaluated/applied just once.

* pam-services “su”, “sudo”, and possibly “passwd” are not actually
  modified when I check their names (as I do in this patch).  If I
  extend all pam-services without checking their names they do get
  modified.  With the attached patch the pam file for “su” does not get
  the pam entry for “pam_limits.so”.

I’d be glad if someone could give me a hint as to what’s going on here.
It would also help if you cannot reproduce it; then it’s probably
something to do with the state of my working directory.

~~ Ricardo


[-- Attachment #2: 0001-WIP-support-for-pam_limits.so.patch --]
[-- Type: text/x-patch, Size: 2455 bytes --]

From cfe06b7c37035ab95e7b527fcde3a785f9e7de13 Mon Sep 17 00:00:00 2001
From: Ricardo Wurmus <rekado@elephly.net>
Date: Fri, 1 Apr 2016 08:50:50 +0200
Subject: [PATCH] WIP support for pam_limits.so

---
 gnu/services/base.scm | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/gnu/services/base.scm b/gnu/services/base.scm
index a006c00..2c256ad 100644
--- a/gnu/services/base.scm
+++ b/gnu/services/base.scm
@@ -3,6 +3,7 @@
 ;;; Copyright © 2015, 2016 Alex Kost <alezost@gmail.com>
 ;;; Copyright © 2015 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2015 Sou Bunnbu <iyzsong@gmail.com>
+;;; Copyright © 2016 Ricardo Wurmus <rekado@elephly.net>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -93,6 +94,9 @@
             gpm-service-type
             gpm-service
 
+            pam-limits-service-type
+            pam-limits-service
+
             %base-services))
 
 ;;; Commentary:
@@ -818,6 +822,40 @@ settings.
 information on the configuration file syntax."
   (service syslog-service-type config-file))
 
+(define pam-limits-service-type
+  ;; Create /etc/security containing the provided "limits.conf" file.
+  (define (security-limits limits-file)
+    `(("security"
+       ,(computed-file
+         "security"
+         #~(begin (mkdir #$output)
+                  (stat #$limits-file)
+                  (symlink #$limits-file
+                           (string-append #$output "/limits.conf")))))))
+  (define (pam-extension pam)
+    (let ((pam-limits (pam-entry
+                       (control "required")
+                       (module "pam_limits.so")
+                       (arguments '("conf=/etc/security/limits.conf")))))
+      (if (member (pam-service-name pam)
+                  '("login" "su" "slim"))
+          (pam-service
+           (inherit pam)
+           (session (cons pam-limits
+                          (pam-service-session pam))))
+          pam)))
+  (service-type
+   (name 'limits)
+   (extensions
+    (list (service-extension etc-service-type security-limits)
+          (service-extension pam-root-service-type
+                             (lambda _ (list pam-extension)))))))
+
+(define* (pam-limits-service #:optional (limits (plain-file "limits.conf" "")))
+  "Return a service that makes selected programs respect the limits specified
+in LIMITS via pam_limits.so."
+  (service pam-limits-service-type limits))
+
 \f
 ;;;
 ;;; Guix services.
-- 
2.7.3


^ permalink raw reply related	[flat|nested] 11+ messages in thread
end of thread, other threads:[~2016-07-20  5:29 UTC | newest]

Thread overview: 11+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-04-01  7:01 [RFC] Support for pam_limits.so: “su” is ignored Ricardo Wurmus
2016-04-01 11:00 ` Ludovic Courtès
2016-04-02  7:23   ` Ricardo Wurmus
2016-04-02 14:44     ` Ludovic Courtès
2016-04-02 17:34       ` Ricardo Wurmus
2016-04-03 21:42         ` Ludovic Courtès
2016-04-05  7:47           ` Ricardo Wurmus
2016-04-05  9:48             ` Ludovic Courtès
2016-07-17 19:52             ` [PATCH] Add pam-limits-service. (was: [RFC] Support for pam_limits.so: “su” is ignored.) Ricardo Wurmus
2016-07-18 12:29               ` [PATCH] Add pam-limits-service Ludovic Courtès
2016-07-20  5:28                 ` Ricardo Wurmus

Code repositories for project(s) associated with this external index

	https://git.savannah.gnu.org/cgit/guix.git

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.