[grsec] Urgent problem: denied resource overstep

[pageexec at freemail.hu]

On 8 Jul 2005 at 13:18, Martijn Grendelman wrote:
> Unfortunately, I don't really understand why this is happening. Where does 
> that limit 256 come from? I don't use customised resource limits, and a 
> simple 'ulimit -u' returns 7168. And if 256 is the limit, how can the system 
> at all get up to 328? Root had about 325 processes running at the time this 
> error occurred, so I just assume that this is what's happening.

all this makes me think that it's your ftpd (or inetd) itself that
sets its own rlimit. and strace or a look at the config files could
confirm it. you said this had started to happen a few days ago, did
you maybe update/change something then in your ftpd/inetd?

> Is there a way to switch off these checks in grsecurity (no, 
> kernel.grsecurity.execve_limiting doesn't do it), or even better: how can I 
> increase the limit grsecurity uses?

the resource limit enforcement comes from the kernel itself, grsec
is only reporting it. if you've got an RBAC policy then you can also
set the initial NPROC limit, but the app can still change it itself.