limit nofile has no effect?

[Steve Langasek]

On Fri, May 27, 2011 at 02:26:22PM +0100, James Hunt wrote:
> On 20/05/11 17:48, pablo platt wrote:
> > I'm using upstart to start an erlang web server.
> > I'm using limit nofile to increase the number of allowed file
> > descriptors but when checking the limits I'm still seeing the default.
> > I'm getting errors for too many open file descriptors.

> > Am I doing something wrong?
> No, it's just that "limit nofile" currently simply calls setrlimit(2) on
> behalf of the application.

In more detail:

> > When increasing the nofile in the /etc/security/limits.conf file, the
> > errors goes away:
> > * soft nofile 30000
> > * hard nofile 30000
> > 
> > I'm checking the beam (the process that is running the erlang vm) with:
> > pidof beam
> > cat /proc/<pid>/limits
> > ...
> > Max open files            1024                 4096                 files
> > ...
> > 
> > the upstart script:
> > --------------------------
> > limit nofile 20000 20000
> > 
> > start on (local-filesystems and net-device-up IFACE!=lo)
> > stop on runlevel [016]
> > 
> > export HOME=/var/lib/myapp
> > 
> > 
> > script
> >     exec sudo -u myapp -i myapp start
> > end script
> > 
> > pre-stop script
> >     exec sudo -u myapp -i myapp stop
> > end script

The problem here is that you're calling sudo in your upstart job, which is a
PAM-based service.  So upstart is setting the fd limit as you request, but
then you're calling sudo which calls into pam_limits and the limit is reset.

You should not use sudo (or su) in system upstart jobs because this results
in a user session associated with the job.  To change uids in an upstart job
without launching a PAM session (on Debian or Ubuntu), I recommend using
'start-stop-daemon -u myapp'.

James, Scott, has any thought been given to including uid/gid or user/group
as verbs in upstart jobs?  Seems to me this would be perfectly consistent
with the existing umask, nice, oom, chroot, and limit verbs.

-- 
Steve Langasek                   Give me a lever long enough and a Free OS
Debian Developer                   to set it on, and I can move the world.
Ubuntu Developer                                    http://www.debian.org/
slangasek at ubuntu.com                                     vorlon at debian.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 828 bytes
Desc: Digital signature
URL: <https://lists.ubuntu.com/archives/upstart-devel/attachments/20110601/5e45c0db/attachment.pgp>