thing is that rlimits have two interfaces: setrlimit(2) which only works
for the process that invoked it, and sysctl where you can change another
process' limits. changing rlimits goes through the same code path for
both now, and the more restrictive checks were done in the former case
too, leading to the problem you were experiencing.

we need to think if we want to add another parameter to the context (for
who the "caller" is -- lwp or proc I guess), add a "_SELF" request (no)
or just do what I did in the patch posted.

since the context might need exporting to other systems for decision
making I'd personally go with the first solution and skip the tests of
the source and target processes are the same.

-e.

Paulo Alexandre Pinto Pires wrote:
> Em Quinta 04 Janeiro 2007 15:10, Elad Efrat escreveu:
>> Juan RP wrote:
>>> On Thursday 04 January 2007 11:05, Elad Efrat wrote:
>>>> try this.
>>> Postfix does not complain anymore with this patch, thanks.
>> this isn't a correct fix. it's just to verify this is the problem.
>>
>> -e.
> 
> Hi, Elad.
> 
> I cannot test it right now, but I believe Juan's tests were like the ones I'd 
> perform.  Last time I tested, every setuid program failed in setrlimit().  Is 
> there a rationale for such behavior, or was it just an accident?
>