bugDatabase-driven manual pager suite - Bugs: bug #37608, man fron man-db package overstep...


bug #37608: man fron man-db package overstep RLIMIT_NPROC when run as root

Submitter:  Ilya Tumaykin <coacher>
Submitted:  Sun 21 Oct 2012 06:11:37 PM UTC
Category:  None Severity:  3 - Normal
Item Group:  None Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup

Sun 21 Oct 2012 06:11:37 PM UTC, original submission:  


I have a Gentoo amd64 machine with man-db 2.6.3 and linux kernel 3.5.4 patched with grsecurity patches. Every time I run `man man` as root I get lots of the following warnings in syslog:

grsec: From denied resource overstep by requesting 106 for RLIMIT_NPROC against limit 100 for /usr/bin/man[man:15604] uid/euid:0/13 gid/egid:0/0, parent /usr/bin/man[man:15603] uid/euid:0/13 gid/egid:0/0

When this command run as non-root user from a wheel group or as man user itself everything is fine.
Appropriate parts of limits.conf:

*               hard    nproc           100
@wheel          hard    nproc           2048
man             hard    nproc           500

Of course, root is also in wheel group and `ulimit -aH` as root says:

core file size          (blocks, -c) 100000
data seg size           (kbytes, -d) unlimited
scheduling priority             (-e) 0
file size               (blocks, -f) unlimited
pending signals                 (-i) 30498
max locked memory       (kbytes, -l) 64
max memory size         (kbytes, -m) unlimited
open files                      (-n) 4096
pipe size            (512 bytes, -p) 8
POSIX message queues     (bytes, -q) 819200
real-time priority              (-r) 0
stack size              (kbytes, -s) unlimited
cpu time               (seconds, -t) unlimited
max user processes              (-u) 2048
virtual memory          (kbytes, -v) unlimited
file locks                      (-x) unlimited

I wonder, why root user is treated so specially by man-db and doesn't have the appropriate limits? And why there are more than 100 threads (or forks or smth else) just to show man page?

I've attached a couple of debugging outputs and an strace one. Could you please answer the above questions?

Ilya Tumaykin <coacher>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

Attached Files
file #26809:  man -d man output (as root) added by coacher (109KiB - application/octet-stream)
file #26810:  strace -C man -d man output (as root) added by coacher (198KiB - application/octet-stream)
file #26811:  man -d man output (as user) added by coacher (109KiB - application/octet-stream)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by coacher (Submitted the item)
  • -email is unavailable- added by coacher

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.


    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2012-10-21 coacher Attached File- Added man -d man output (as root), #26809
        Attached File- Added strace -C man -d man output (as root), #26810
        Attached File- Added man -d man output (as user), #26811
        Carbon-Copy- Added coacher

    Back to the top

    Powered by Savane 3.13-6ae7.
    Corresponding source code