Merge pull request #10935 from poettering/rlimit-nofile-safe

Merged by hand to resolve a trivial conflict in TODO.
2018-12-06 17:19:21 +01:00
parent f0a43eb821 707b3fbd57
commit 871fa294ff
29 changed files with 124 additions and 41 deletions
@@ -29,6 +29,10 @@ Features:

 * when we fork off generators and such, lower LIMIT_NOFILE soft limit to 1K

+* Maybe introduce a helper safe_exec() or so, which is to execve() which
+  safe_fork() is to fork(). And then make revert the RLIMIT_NOFILE soft limit
+  to 1K implicitly, unless explicitly opted-out.
+
 * rework seccomp/nnp logic that that even if User= is used in combination with
  a seccomp option we don't have to set NNP. For that, change uid first whil
  keeping CAP_SYS_ADMIN, then apply seccomp, the drop cap.