| Summary: | sys-apps/systemd: pam limits are not applied to a user session | ||
|---|---|---|---|
| Product: | Gentoo Linux | Reporter: | Alexander Tsoy <alexander> |
| Component: | Current packages | Assignee: | Gentoo systemd Team <systemd> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | sam, zlogene |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Package list: | Runtime testing required: | --- | |
Of course, this can be worked around to some extent. For example, I ended up using this: $ cat /etc/systemd/system/user@1000.service.d/limits.conf [Service] LimitRTPRIO=99 LimitMEMLOCK=infinity The patch failed to apply at some point, and I couldn't find the justification for why I added it in the first place. The bug has been closed via the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=38ec013fbbf4b11185706d21fd079881f628f272 commit 38ec013fbbf4b11185706d21fd079881f628f272 Author: Mike Gilbert <floppym@gentoo.org> AuthorDate: 2020-11-03 15:48:10 +0000 Commit: Mike Gilbert <floppym@gentoo.org> CommitDate: 2020-11-03 15:48:10 +0000 sys-apps/systemd: include system-auth in PAM config Closes: https://bugs.gentoo.org/751199 Signed-off-by: Mike Gilbert <floppym@gentoo.org> sys-apps/systemd/files/gentoo-pam.patch | 33 +++++++++++++++++++++++++++++++++ sys-apps/systemd/systemd-246.6.ebuild | 1 + sys-apps/systemd/systemd-9999.ebuild | 1 + 3 files changed, 35 insertions(+) |
PAM limits no longer applies to a user session since "gentoo-systemd-user-pam.patch" was dropped. I'm not quite sure why this was done in Gentoo. Other distros still ships their own systemd-user PAM configuration fragments: [1],[2]. This is also covered in the NEWS item for 232 release: * The PAM configuration fragment file for "user@.service" shipped with systemd (i.e. the --user instance of systemd) has been stripped to the minimum necessary to make the system boot. Previously, it contained Fedora-specific stanzas that did not apply to other distributions. It is expected that downstream distributions add additional configuration lines, matching their needs to this file, using it only as rough template of what systemd itself needs. Note that this reduced fragment does not even include an invocation of pam_limits which most distributions probably want to add, even though systemd itself does not need it. (There's also the new build time option --with-pamconfdir=no to disable installation of the PAM fragment entirely.) [1] https://git.archlinux.org/svntogit/packages.git/tree/trunk/systemd-user.pam?h=packages/systemd [2] https://src.fedoraproject.org/rpms/systemd/blob/master/f/systemd-user