Package: libpam-modules Version: 1.3.1-5 Severity: important Hi,
Since systemd v246 RLIMIT_MEMLOCK, on a clean installation, is set to 1/8th of memory (before that, since v240 it was set to 64MB, instead of the previous 64KB) for anything going through pam_limit. That's too high. The reason for that is that https://salsa.debian.org/vorlon/pam/-/blob/master/debian/patches-applied/027_pam_limits_better_init_allow_explicit_root#L66 causes rlimits to be copied from the pid 1 whenever pam_limits is used, and /etc/security/limits.{conf,d} doesn't specify it. The one exception to that is RLIMIT_NOFILE that's clamped to FD_SETSIZE via https://salsa.debian.org/vorlon/pam/-/blob/master/debian/patches-applied/pam-limits-nofile-fd-setsize-cap The systemd changes leading to this are https://github.com/systemd/systemd/commit/04d1ee0f7ec7a280136ddf5f3f34d6282a50846d https://github.com/systemd/systemd/commit/c8884aceefc85245b9bdfb626e2daf27521259bd Clearly this is very related to https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=917374 but the consequences are different enough (particularly because the clamping makes the NOFILE issue fairly harmless). Regards, Andres Freund -- System Information: Debian Release: bullseye/sid APT prefers unstable-debug APT policy: (500, 'unstable-debug'), (500, 'unstable'), (1, 'experimental-debug'), (1, 'experimental') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 5.10.0-rc5-andres-00354-g464e30a412ac (SMP w/40 CPU threads) Kernel taint flags: TAINT_WARN Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) Versions of packages libpam-modules depends on: ii debconf [debconf-2.0] 1.5.74 ii libaudit1 1:2.8.5-3.1 ii libc6 2.31-5 ii libdb5.3 5.3.28+dfsg1-0.6 ii libpam-modules-bin 1.3.1-5 ii libpam0g 1.3.1-5 ii libselinux1 3.1-2+b1 libpam-modules recommends no packages. libpam-modules suggests no packages. -- Configuration Files: /etc/security/limits.conf changed [not included] -- debconf information excluded
