Hello,
Am Dienstag, 29. November 2016, 10:43:47 CET schrieb Steve Beattie:
> On Tue, Nov 29, 2016 at 01:49:05PM +0100, Christian Boltz wrote:
> > On servers with not too much memory ("only" 16 GB), dovecot logins
> > fail:
> >
> > Nov 25 21:35:15 server dovecot[28737]: master: Fatal:
> > setrlimit(RLIMIT_DATA, 268435456): Permission denied
> > Nov 2521:35:15 server dovecot[28731]: master: Error: service(auth):
> > command startup failed, throttling for 2 secs Nov 25 21:35:15
> > server dovecot[28737]: auth: Fatal: master: service(auth): child
> > 25976 returned error 89 (Fatal failure)
> >
> > audit.log messages are:
> > ... apparmor="DENIED" operation="capable"
> > profile="/usr/sbin/dovecot" pid=25000 comm="dovecot" capability=24
> > capname="sys_resource" ... apparmor="DENIED" operation="setrlimit"
> > profile="/usr/sbin/dovecot" pid=25000 comm="dovecot" rlimit=data
> > value=268435456
> Interesting. This should only be needed if raising RLIMIT_DATA
> ('ulimit -H -d' in bash/dash) over an existing hard limit. Is there
> some setting elsewhere that's lowering it before dovecot runs?That's an interesting[tm] question. Testing in the shell tells me "unlimited", and dovecot.service also doesn't show any restrictions. (Maybe dovecot lowers the limit somewhere, and later tries to raise it again?) Wild guess: 268435456 / 1024 / 1024 = 256 MB - and that seems to be the default value of dovecot's default virtual memory size (default_vsz_limit) which is used at several places, and at least explains why dovecot wants to raise the limit to this value. Fun fact - it seems we "survived" this for quite a while - I found a report about a similar SELinux denial from 2012 ;-) http://forums.fedoraforum.org/archive/index.php/t-284859.html > > After allowing capability sys_resource, dovecot can increase the > > limit and works again. > > > > I propose this patch for trunk, 2.10 and 2.9 > > That question aside, I think it's okay. > Acked-by: Steve Beattie <[email protected]> for all three branches. Thanks! May I remind you that [patch] logparser.py: improve file vs. network event recognition is still waiting for a review? ;-) Regards, Christian Boltz -- Ich glaube übrigens, daß es Suse nicht mehr lange gibt: - Ich verwende Evolution. Evolution gehört jetzt zu Novell. - Suse gehört jetzt auch zu Novell. Die Rechtschreibprüfung von Evolution(Novell) kennt aber das Wort "Suse" nicht!!!! Got it???? Die wissen mehr! [Ratti in fontlinge-devel]
signature.asc
Description: This is a digitally signed message part.
-- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
