setrlimit(): Operation not permitted [core/uwsgi.c line 2157]

[77cc33]

ubuntu 12.04 lts 64 bit

I have /etc/security/limits.conf set as 135K

www-data hard nofile 133333 www-data soft nofile 133333 root hard nofile 133333 root soft nofile 133333

• I enabled pam_security module, so when I log in as root or www-data - I have: ulimit -n 133333

but when I start uwsgi, it shows me: detected max file descriptor number: 1024

I tried to set fd-max, and got this: setrlimit(): Operation not permitted [core/uwsgi.c line 2157] detected max file descriptor number: 1024

I start uwsgi as root with help of emperor and later set uid to www-data

is there some workaround to fix it ASAP?

[unbit]

every application wanting to use pam, must explicitely support it. You have to load the "pam" plugin and use --pam or --pam-user (based on your need). The pam plugin is not builtin by default but its only dependancies are the pam development headers.

[unbit]

in addition to this, remember you can set the max-fd in the emperor, and this limit will be inherited by vassal (without bothering with pam)

[77cc33]

I tried emperor, and it didn't work. it's my ubuntu upstart init script

Emperor uWSGI script

description "uWSGI Emperor"; start on runlevel [2345] stop on runlevel [06]

exec uwsgi \ --master \ --die-on-term \ --emperor /etc/uwsgi \ --logto /var/log/uwsgi/emperor.log \ --logdate \ --auto-procname \ --no-orphans \ --need-app \ --max-fd 30000

and it's what I have in my emperor log Fri Mar 29 07:48:48 2013 - detected max file descriptor number: 30000

and it what I have in application log setrlimit(): Operation not permitted [core/uwsgi.c line 2157] detected max file descriptor number: 1024

[unbit]

you are right, setrlimit is called too late, while it should be called before privileges drop, will be fixed in the next few minutes

[unbit]

hmm should be managed in another way, as it could be a security problem allowing the user to increase its max-fd before privileges drop. Will leave this open, i will post the solution as soon as possible

[unbit]

you can try with latest code from github and adding --max-fd to the emperor. The vassals wil inherit the limit.

From now on this is the blessed way

[77cc33]

thank you!

just wanted to aprove that it works now!