According some other questions and answers, I expected the same results for both commands, but that's not the case.

furthermore, running a process from sudo, terminated with "too many open files", where running as root didn't. What is the difference exactly between the 2 ?

nati@server:/var/tmp$ sudo bash  -c "ulimit -n"
nati@server:/var/tmp$ sudo su
root@server:/var/tmp# ulimit -n
  • ulimit -n tells you the limit on open files without grep. – countermode Dec 20 '16 at 9:03
  • @countermode - Thanks, I'll update the question, but the results are the same... – Nati Dec 20 '16 at 9:06
  • what kind of system is this? I checked over here, and ulimit -n outputs 1024 for root and non-root on two different distros. Apparently, there's something configured in /etc/security/limits.conf - please check. – countermode Dec 20 '16 at 9:21
  • This is Ubuntu 14.04. obviously that's after /etc/security/limits.conf was configured with root soft nofile 32000 – Nati Dec 20 '16 at 9:24

/etc/security/limits.conf is used by pam_limits. An authentication module such as su, sudo, or login invokes PAM modules according to the PAM description. For most distros that means to pick up the according entry in /etc/pam.d/. For instance, this may be /etc/pam.d/sudo; for Gentoo that looks like

auth    include         system-auth
account include         system-auth
session include         system-auth

where system-auth has a line like

session         required        pam_limits.so 

Therefore, the resource limits are configured as defined in /etc/security/limits.conf.

For my Kali installation, that looks different. pam_limits is not invoked for sudo. Apparently, all Debian anchestors share this "feature". Experimenting with /etc/security/limits.conf confirms your observation - on sudo I get 1024 while for login I get what I configured in limits.conf.

  • Cool ! thanks. but where exactly did you see that pam_limits.so is invoked for sudo ? – Nati Dec 21 '16 at 8:03
  • You just need to follow all include directives. In the example above for Gentoo that means to look up /etc/pam.d/system-auth, where indeed pam_limits is invoked. – countermode Dec 23 '16 at 0:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.