• Simon McVittie's avatar
    bus: Try to raise soft fd limit to match hard limit · 94bacc69
    Simon McVittie authored
    Linux systems have traditionally set the soft limit to 1024 and the hard
    limit to 4096. Recent versions of systemd keep the soft fd limit at
    1024 to avoid breaking programs that still use select(), but raise the
    hard limit to 512*1024, while in recent Debian versions a complicated
    interaction between components gives a soft limit of 1024 and a hard
    limit of 1024*1024. If we can, we might as well elevate our soft limit
    to match the hard limit, minimizing the chance that we will run out of
    file descriptor slots.
    
    Unlike the previous code to raise the hard and soft limits to at least
    65536, we do this even if we don't have privileges: privileges are
    unnecessary to raise the soft limit up to the hard limit.
    
    If we *do* have privileges, we also continue to raise the hard and soft
    limits to at least 65536 if they weren't already that high, making
    it harder to carry out a denial of service attack on the system bus on
    systems that use the traditional limit (CVE-2014-7824).
    
    As was previously the case on the system bus, we'll drop the limits back
    to our initial limits before we execute a subprocess for traditional
    (non-systemd) activation, if enabled.
    
    systemd activation doesn't involve us starting subprocesses at all,
    so in both cases activated services will still inherit the same limits
    they did previously.
    
    This change also fixes a bug when the hard limit is very large but
    the soft limit is not, for example seen as a regression when upgrading
    to systemd >= 240 (Debian #928877). In such environments, dbus-daemon
    would previously have changed its fd limit to 64K soft/64K hard. Because
    this hard limit is less than its original hard limit, it was unable to
    restore its original hard limit as intended when carrying out traditional
    activation, leaving activated subprocesses with unintended limits (while
    logging a warning).
    Reviewed-by: Lennart Poettering's avatarLennart Poettering <lennart@poettering.net>
    [smcv: Correct a comment based on Lennart's review, reword commit message]
    Signed-off-by: Simon McVittie's avatarSimon McVittie <smcv@collabora.com>
    (cherry picked from commit 7eacbfec)
    [smcv: Mention that this also fixes Debian #928877]
    94bacc69
Name
Last commit
Last update
..
.gitignore Loading commit data...
Makefile.am Loading commit data...
Version.in Loading commit data...
dbus-address.c Loading commit data...
dbus-address.h Loading commit data...
dbus-arch-deps.h.in Loading commit data...
dbus-asv-util.c Loading commit data...
dbus-asv-util.h Loading commit data...
dbus-auth-script.c Loading commit data...
dbus-auth-script.h Loading commit data...
dbus-auth-util.c Loading commit data...
dbus-auth.c Loading commit data...
dbus-auth.h Loading commit data...
dbus-bus.c Loading commit data...
dbus-bus.h Loading commit data...
dbus-connection-internal.h Loading commit data...
dbus-connection.c Loading commit data...
dbus-connection.h Loading commit data...
dbus-credentials-util.c Loading commit data...
dbus-credentials.c Loading commit data...
dbus-credentials.h Loading commit data...
dbus-dataslot.c Loading commit data...
dbus-dataslot.h Loading commit data...
dbus-errors.c Loading commit data...
dbus-errors.h Loading commit data...
dbus-file-unix.c Loading commit data...
dbus-file-win.c Loading commit data...
dbus-file.c Loading commit data...
dbus-file.h Loading commit data...
dbus-hash.c Loading commit data...
dbus-hash.h Loading commit data...
dbus-init-win.cpp Loading commit data...
dbus-internals.c Loading commit data...
dbus-internals.h Loading commit data...
dbus-keyring.c Loading commit data...
dbus-keyring.h Loading commit data...
dbus-list.c Loading commit data...
dbus-list.h Loading commit data...
dbus-macros.h Loading commit data...
dbus-mainloop.c Loading commit data...
dbus-mainloop.h Loading commit data...
dbus-marshal-basic.c Loading commit data...
dbus-marshal-basic.h Loading commit data...
dbus-marshal-byteswap-util.c Loading commit data...
dbus-marshal-byteswap.c Loading commit data...
dbus-marshal-byteswap.h Loading commit data...
dbus-marshal-header.c Loading commit data...
dbus-marshal-header.h Loading commit data...
dbus-marshal-recursive-util.c Loading commit data...
dbus-marshal-recursive.c Loading commit data...
dbus-marshal-recursive.h Loading commit data...
dbus-marshal-validate-util.c Loading commit data...
dbus-marshal-validate.c Loading commit data...
dbus-marshal-validate.h Loading commit data...
dbus-memory.c Loading commit data...
dbus-memory.h Loading commit data...
dbus-mempool.c Loading commit data...
dbus-mempool.h Loading commit data...
dbus-message-factory.c Loading commit data...
dbus-message-factory.h Loading commit data...
dbus-message-internal.h Loading commit data...
dbus-message-private.h Loading commit data...
dbus-message-util.c Loading commit data...
dbus-message.c Loading commit data...
dbus-message.h Loading commit data...
dbus-misc.c Loading commit data...
dbus-misc.h Loading commit data...
dbus-nonce.c Loading commit data...
dbus-nonce.h Loading commit data...
dbus-object-tree.c Loading commit data...
dbus-object-tree.h Loading commit data...
dbus-pending-call-internal.h Loading commit data...
dbus-pending-call.c Loading commit data...
dbus-pending-call.h Loading commit data...
dbus-pipe-unix.c Loading commit data...
dbus-pipe-win.c Loading commit data...
dbus-pipe.c Loading commit data...
dbus-pipe.h Loading commit data...
dbus-protocol.h Loading commit data...
dbus-resources.c Loading commit data...
dbus-resources.h Loading commit data...
dbus-server-debug-pipe.c Loading commit data...
dbus-server-debug-pipe.h Loading commit data...
dbus-server-launchd.c Loading commit data...
dbus-server-launchd.h Loading commit data...
dbus-server-protected.h Loading commit data...
dbus-server-socket.c Loading commit data...
dbus-server-socket.h Loading commit data...
dbus-server-unix.c Loading commit data...
dbus-server-unix.h Loading commit data...
dbus-server-win.c Loading commit data...
dbus-server-win.h Loading commit data...
dbus-server.c Loading commit data...
dbus-server.h Loading commit data...
dbus-sha.c Loading commit data...
dbus-sha.h Loading commit data...
dbus-shared.h Loading commit data...
dbus-shell.c Loading commit data...
dbus-shell.h Loading commit data...
dbus-signature.c Loading commit data...
dbus-signature.h Loading commit data...
dbus-socket-set-epoll.c Loading commit data...
dbus-socket-set-poll.c Loading commit data...
dbus-socket-set.c Loading commit data...
dbus-socket-set.h Loading commit data...
dbus-sockets-win.h Loading commit data...
dbus-spawn-test.c Loading commit data...
dbus-spawn-win.c Loading commit data...
dbus-spawn.c Loading commit data...
dbus-spawn.h Loading commit data...
dbus-string-private.h Loading commit data...
dbus-string-util.c Loading commit data...
dbus-string.c Loading commit data...
dbus-string.h Loading commit data...
dbus-syntax.c Loading commit data...
dbus-syntax.h Loading commit data...
dbus-sysdeps-pthread.c Loading commit data...
dbus-sysdeps-thread-win.c Loading commit data...
dbus-sysdeps-unix.c Loading commit data...
dbus-sysdeps-unix.h Loading commit data...
dbus-sysdeps-util-unix.c Loading commit data...
dbus-sysdeps-util-win.c Loading commit data...
dbus-sysdeps-util.c Loading commit data...
dbus-sysdeps-win.c Loading commit data...
dbus-sysdeps-win.h Loading commit data...
dbus-sysdeps-wince-glue.c Loading commit data...
dbus-sysdeps-wince-glue.h Loading commit data...
dbus-sysdeps.c Loading commit data...
dbus-sysdeps.h Loading commit data...
dbus-test-main.c Loading commit data...
dbus-test.c Loading commit data...
dbus-test.h Loading commit data...
dbus-threads-internal.h Loading commit data...
dbus-threads.c Loading commit data...
dbus-threads.h Loading commit data...
dbus-timeout.c Loading commit data...
dbus-timeout.h Loading commit data...
dbus-transport-protected.h Loading commit data...
dbus-transport-socket.c Loading commit data...
dbus-transport-socket.h Loading commit data...
dbus-transport-unix.c Loading commit data...
dbus-transport-unix.h Loading commit data...
dbus-transport-win.c Loading commit data...
dbus-transport-win.h Loading commit data...
dbus-transport.c Loading commit data...
dbus-transport.h Loading commit data...
dbus-types.h Loading commit data...
dbus-userdb-util.c Loading commit data...
dbus-userdb.c Loading commit data...
dbus-userdb.h Loading commit data...
dbus-uuidgen.c Loading commit data...
dbus-uuidgen.h Loading commit data...
dbus-valgrind-internal.h Loading commit data...
dbus-watch.c Loading commit data...
dbus-watch.h Loading commit data...
dbus.h Loading commit data...
versioninfo.rc.in Loading commit data...