Re: [RFC] Support for pam_limits.so: “su” is ignored.

[Ricardo Wurmus]

Ludovic Courtès <address@hidden> writes:

> Ricardo Wurmus <address@hidden> skribis:
>
>> * pam-services “su”, “sudo”, and possibly “passwd” are not actually
>>   modified when I check their names (as I do in this patch).  If I
>>   extend all pam-services without checking their names they do get
>>   modified.  With the attached patch the pam file for “su” does not get
>>   the pam entry for “pam_limits.so”.
>
> But it works for me!  :-)
>
> I’ve applied the attached patch (fixes a minor syntax issue in the patch
> you sent), and then did:

Oh, yes, I must have sent another version.  Attached is the version I
used.

>
> --8<---------------cut here---------------start------------->8---
> $ ./pre-inst-env guix system build ~/src/configuration/pluto-configuration.scm
> substitute: updating list of substitutes from 
> 'https://mirror.hydra.gnu.org'... 100.0%
> substitute: updating list of substitutes from 'https://hydra.gnu.org'... 
> 100.0%
> La jenaj derivoj estos konstruataj:
>    /gnu/store/0fxwylcmdxy7bqmjpxwqf24v2x4yr53w-system.drv
>    /gnu/store/q254gqx3rgwxn98nsaz16z8rl58nhfkw-shepherd.conf.drv
>    /gnu/store/517cxw8xiniwsh9bfdp389qxlm9w5jj8-activate-service.drv
>    /gnu/store/ky8p3bq0xpj3lf989fz1ba3j2xycyiz6-activate.drv
>    /gnu/store/ljjl4zs722flxbpip8jdssqd549g7pay-boot.drv
>    /gnu/store/vz8745sdk0ph0rykxldwzmfa3a5r7cm1-etc.drv
> /gnu/store/s84hvl064k494174z692wl1vaqzrygln-system
> address@hidden ~/src/guix$ grep pam_limit 
> /gnu/store/s84hvl064k494174z692wl1vaqzrygln-system/etc/pam.d/*
> /gnu/store/s84hvl064k494174z692wl1vaqzrygln-system/etc/pam.d/login:session 
> required pam_limits.so conf=/etc/security/limits.conf
> /gnu/store/s84hvl064k494174z692wl1vaqzrygln-system/etc/pam.d/slim:session 
> required pam_limits.so conf=/etc/security/limits.conf
> /gnu/store/s84hvl064k494174z692wl1vaqzrygln-system/etc/pam.d/su:session 
> required pam_limits.so conf=/etc/security/limits.conf
> --8<---------------cut here---------------end--------------->8---
>
> … where the configuration in question has (pam-limits-service) in its
> ‘services’ field.

How odd.  It does not work for me:

--8<---------------cut here---------------start------------->8---
rekado in guix: ./pre-inst-env guix system build /etc/config.scm
substitute: updating list of substitutes from 'https://hydra.gnu.org'... 100.0%
The following derivations will be built:
   /gnu/store/8pldcwijn1szpyc4cbm4z808sbdn18r0-system.drv
   /gnu/store/x2pigxf3mrf5crbmnjfxza8h3a70fvnv-activate-service.drv
   /gnu/store/nwm5gsfavv35g3hjgzi5xymhxhqf2g4l-activate.drv
   /gnu/store/38x73bdqj40wmy3lz8qnpfc20wb0dr6x-boot.drv
   /gnu/store/mlkssjhw4avm8a37yi0nfk4z4zd9bkj6-security.drv
   /gnu/store/1lxncnhdab3l732r144r5ww0y9rjq72f-etc.drv
/gnu/store/qwjbfjzqlbdcrsbnyyjylfkhm6kqna5d-system
rekado in guix: grep limits 
/gnu/store/qwjbfjzqlbdcrsbnyyjylfkhm6kqna5d-system/etc/pam.d/*
/gnu/store/qwjbfjzqlbdcrsbnyyjylfkhm6kqna5d-system/etc/pam.d/login:session 
required pam_limits.so conf=/etc/security/limits.conf
/gnu/store/qwjbfjzqlbdcrsbnyyjylfkhm6kqna5d-system/etc/pam.d/slim:session 
required pam_limits.so conf=/etc/security/limits.conf
--8<---------------cut here---------------end--------------->8---

When my configuration looks like this:

      (services (list (pam-limits-service)))

Then there’s one file containing pam_limits, namely “/etc/pam.d/su”.
When my configuration looks like this, however:

      (services (cons* (pam-limits-service)
                       %desktop-services))

Then only “/etc/pam.d/login” and “/etc/pam.d/slim” contain pam_limits;
“/etc/pam.d/su” does not.

~~ Ricardo

>From 5bb848b73a19b5ebaa301c7c6bdedbd4a3bab8b6 Mon Sep 17 00:00:00 2001
From: Ricardo Wurmus <address@hidden>
Date: Mon, 12 Oct 2015 07:11:51 +0200
Subject: [PATCH] services: Add pam entry for pam_limits.

* gnu/services/base.scm (pam-limits-service-type): WIP support for
  pam_limits.so
---
 gnu/services/base.scm | 40 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)

diff --git a/gnu/services/base.scm b/gnu/services/base.scm
index b168543..7e0fbd4 100644
--- a/gnu/services/base.scm
+++ b/gnu/services/base.scm
@@ -3,6 +3,7 @@
 ;;; Copyright © 2015, 2016 Alex Kost <address@hidden>
 ;;; Copyright © 2015 Mark H Weaver <address@hidden>
 ;;; Copyright © 2015 Sou Bunnbu <address@hidden>
+;;; Copyright © 2016 Ricardo Wurmus <address@hidden>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -93,6 +94,9 @@
             gpm-service-type
             gpm-service
 
+            pam-limits-service-type
+            pam-limits-service
+
             %base-services))
 
 ;;; Commentary:
@@ -811,6 +815,42 @@ settings.
 information on the configuration file syntax."
   (service syslog-service-type config-file))
 
+(define pam-limits-service-type
+  (let ((security-limits
+         ;; Create /etc/security containing the provided "limits.conf" file.
+         (lambda (limits-file)
+           `(("security"
+              ,(computed-file
+                "security"
+                #~(begin (mkdir #$output)
+                         (stat #$limits-file)
+                         (symlink #$limits-file
+                                  (string-append #$output 
"/limits.conf"))))))))
+        (pam-extension
+         (lambda (pam)
+           (let ((pam-limits (pam-entry
+                              (control "required")
+                              (module "pam_limits.so")
+                              (arguments 
'("conf=/etc/security/limits.conf")))))
+             (if (member (pam-service-name pam)
+                         '("login" "su" "slim"))
+                 (pam-service
+                  (inherit pam)
+                  (session (cons pam-limits
+                                 (pam-service-session pam))))
+                 pam)))))
+    (service-type
+     (name 'limits)
+     (extensions
+      (list (service-extension etc-service-type security-limits)
+            (service-extension pam-root-service-type
+                               (lambda _ (list pam-extension))))))))
+
+(define* (pam-limits-service #:optional (limits (plain-file "limits.conf" "")))
+  "Return a service that makes selected programs respect the limits specified
+in LIMITS via pam_limits.so."
+  (service pam-limits-service-type limits))
+
 
 ;;;
 ;;; Guix services.
-- 
2.7.3