> Hi there, > > We're busy moving from apache+mod_wsgi to nginx+uwsgi, thanks for making > what looks like an awesome tool! > > We like to apply some resource limits to our users via pam_limit > (/etc/security/limits.conf). > > For example, we can set nproc to limit number of processes for a > particular user. > > However, this does not seem to work with uwsgi processes for that user > -- despite using the uid and gid settings. > > Can you think of any reason why? > > Simple repro: Add the line > > testuser - nproc 10 > > to /etc/security/limits.conf > > then, su to the user, and in python try: > > import subprocess > for _ in range(20): > subprocess.Popen(['python', '-c', 'import time; time.sleep(10)']) > > > And you should see a "resource temporarily unavailable" error. > > > But, if you add the same python code to a wsgi app, serve it via uwsgi > with the --uid=testuser, and you won't see any error. > > So, any idea why? >
Because pam must be voluntary enabled by the application itself. When you login/enter your shell, pam is called, as well as by ssh and so on. But if you run a process and then you call setuid()/setgid() pam must be invoiked again for the new user (and this is not common for a daemon). uWSGI includes a set of features for limiting users, but if you already have a pam infrastructure and want to use it in uWSGI automatically, you may want to fill a feature request on trac or contact [email protected] if you are in a hurry (and do not mind to throw away some money ;). -- Roberto De Ioris http://unbit.it _______________________________________________ uWSGI mailing list [email protected] http://lists.unbit.it/cgi-bin/mailman/listinfo/uwsgi
