* Vincent Danen <vdanen@linsec.ca> [2007-12-21 18:58:48 -0700]:

[...]
> That memory setting should be well under the established limits.  An
> strace shows me:
>
> [root@artemis log]# strace chpst -m 100000 -u vdanen /bin/sh
> execve("/sbin/chpst", ["chpst", "-m", "100000", "-u", "vdanen", "/bin/sh"], [/* 41 vars */]) = 0
> open("/dev/urandom", O_RDONLY)          = 3
> read(3, "\216\266\246\243\vp\245\242", 8) = 8
> close(3)                                = 0
> open("/etc/passwd", O_RDONLY)           = 3
> lseek(3, 0, SEEK_END)                   = 1486
> mmap(NULL, 1486, PROT_READ, MAP_PRIVATE, 3, 0) = 0x2b5440b0a000
> close(3)                                = 0
> munmap(0x2b5440b0a000, 1486)            = 0
> setgroups(1, [1001])                    = 0
> setgid(1001)                            = 0
> setuid(1001)                            = 0
> getrlimit(RLIMIT_DATA, {rlim_cur=12288*1024, rlim_max=RLIM_INFINITY}) = 0
> setrlimit(RLIMIT_DATA, {rlim_cur=100000, rlim_max=RLIM_INFINITY}) = 0
> getrlimit(RLIMIT_STACK, {rlim_cur=8192*1024, rlim_max=RLIM_INFINITY}) = 0
> setrlimit(RLIMIT_STACK, {rlim_cur=100000, rlim_max=RLIM_INFINITY}) = 0
> getrlimit(RLIMIT_MEMLOCK, {rlim_cur=32*1024, rlim_max=32*1024}) = 0
> setrlimit(RLIMIT_MEMLOCK, {rlim_cur=32*1024, rlim_max=32*1024}) = 0
> getrlimit(RLIMIT_AS, {rlim_cur=RLIM_INFINITY, rlim_max=RLIM_INFINITY}) = 0
> setrlimit(RLIMIT_AS, {rlim_cur=100000, rlim_max=RLIM_INFINITY}) = 0
> execve("/bin/sh", ["/bin/sh"], [/* 41 vars */]) = -1 ENOMEM (Cannot allocate memory)
> +++ killed by SIGKILL +++
>
>
> Does anyone know why this is happening?  If I'm recalling correctly, I
> think dietlibc or a change in dietlibc was the culprit before, but I
> can't remember.
>
> Removing the memory restrictions to the chpst calls works well enough,
> but it would be nice to be able to use them since they are there.

/me feels stupid

The problem is bash has been updated and apparently requires more
memory.  Time to replace those scripts with execline-based ones I think.

Sorry for the noise.

-- 
Vincent Danen @ http://linsec.ca/