Avahi, setrlimit NPROC and lxc

Over the weekend I installed Avahi (the open source bonjour equivalent) and bumped into a strange error while trying to restart the service. /var/log/message says chroot.c: fork() failed: Resource temporarily unavailable. Searching the interwebs revealed it is an issue with LXC and setrlimit.

The setrlimit call can limit set cetain limitations on processes. One such limitation is NPROC, the number of processes that can have the same UID. Using setrlimit NPROC can enhance security by preventing unexpected forking, like when an attacker is trying spawn a new process. However, the server I am running on uses LXC, and avahi is installed on the host. In LXC, the containers themselves have isolation between one another, but the host sees all processes. The PIDs of container processes are remapped but their UIDs stay the same. Thus, you will get UID collisions where user 102 of container can refer to say ntp, while 102 of host can refer to avahi. Because the host sees and accounts for all processes, setrlimit on avahi (102) of say 3 processes will also count existing processes in containers with UID 102 (such as ntp) and thus breach the limit and unable to spawn.

The only way to solve this is to edit avahi.conf and set rlimit-nproc or just disable rlimits altogether using the --no-rlimits switch.

I guess as LXC and control groups becomes more common, developers will need to adjust their assumptions about users and processes.

2 thoughts on “Avahi, setrlimit NPROC and lxc

  1. Matthijs Kooijman

    Just ran into this issue as well (and my previous solution, patching the lxc tools didn’t work due to changes in recent kernels [1]). Disabling the nproc limit seems to fix my issue just fine, thanks for that.

    Just for anyone else stumbling upon this post: If you just remove the “rlimit-nproc” line from avahi-daemon.conf, the nproc rlimit gets disabled without affecting any of the other rlimits.

    [1]: http://sourceforge.net/mailarchive/message.php?msg_id=29200350

Leave a Reply

Your email address will not be published. Required fields are marked *