Messages in this thread | | | Date | Fri, 15 Jul 2011 07:35:05 +0200 | From | Willy Tarreau <> | Subject | Re: [PATCH] move RLIMIT_NPROC check from set_user() to do_execve_common() |
| |
Hi Neil,
On Fri, Jul 15, 2011 at 01:30:13PM +1000, NeilBrown wrote: (...) > But what do you think of this. It sure that only the process which ignored > the return value from setuid is inconvenienced. (...)
I think this is a smart idea. But will the flag be inherited by children over a fork() ? If not, we might as well block fork(), because we can expect a lot of fork+exec situations which are as dangerous as the simple execve().
Regards, Willy
| |