<div>Hi,<br></div><div><br></div><div>So by the time that the shell is started, and whether or not it is a login shell is determined, pam has finished all of her work.<br></div><div><br></div><div>A bit of probably pointless background.<br></div><div><br></div><div>pam was designed so that there were pluggable ways of expanding how authentication and authorisation is done at login. This way you can authenticate with a password and authorise with /etc/passwd and /etc/groups like we old timers do. Or you can authenticate with ldap and authorise with a local set of groups, or use Active Directory for authentication and then ldap for authorisation, etc.<br></div><div><br></div><div>The limits setting is in the authorisation step. A quick look on my ubuntu based system shows that limits is called fo:<br></div><div><br></div><div>* cron<br></div><div>* lightdm - the GUI login manger.<br></div><div>* sshd - for ssh<br></div><div>* su<br></div><div>* sudo<br></div><div><br></div><div>Where on my PI it is called for<br></div><div><br></div><div>* cron<br></div><div>* lightdm<br></div><div>* login<br></div><div>* sshd<br></div><div>* su<br></div><div>* vncserver.<br></div><div><br></div><div>Now I use xrdp and it is not called in that case and I have tested that limits are not set.<br></div><div><br></div><div>I'm guessing if one added in the line<br></div><div><br></div><p style="margin: 0px; font-style: normal; font-variant-caps: normal; font-weight: normal; font-stretch: normal; line-height: normal;"><span class="colour" style="color:rgb(0, 0, 0)"><span class="font" style="font-family:Menlo"><span class="size" style="font-size:11px"><span style="font-variant-ligatures: no-common-ligatures">session optional pam_limits.so</span></span></span></span><br></p><div ><br></div><div >to which ever file is the vnc server file in /etc/pam.d on your ubuntu it would work. <br></div><div ><br></div><div >cheers<br></div><div >bruce</div><div class="ik_mail_quote answerContentMessage" ><div>On 2023-01-09T03:09:14.000+01:00, tim Rowledge <tim@rowledge.org> wrote:</div><blockquote class="ws-ng-quote"><pre style="white-space: normal;">The only additional suggestion I've received that might possibly make some sense is "is this an issue of login vs non-login shell?" Does that trigger any ideas for anyone?<br/><br/>And possibly of some value, I note that the config of Raspberry Pi OS does not have this problem; connecting via VNC results in an environment where the ulimit -r value is what we need. I tried poking around at the assorted directories but the limits and pam stuff are sufficiently different that it makes no sense to me.<br/><br/><blockquote class="ws-ng-quote"> On 2023-01-04, at 3:02 PM, tim Rowledge <<a target="_blank" class="defaultMailLink" href="mailto:tim@rowledge.org">tim@rowledge.org</a>> wrote:<br/> <br/> After looking at various file in the /etc/pam.d directory, I also tried adding the <br/> session required pam_<a target="_blank" class="defaultMailLink" href="http://limits.so">limits.so</a><br/> line into the <br/> - /etc/pam.d/common-session<br/> - /etc/pam.d/tigervnc file<br/> <br/> ... with no visible effect.<br/> <br/> And between each attempt I actually rebooted the machine, so it's definitely getting it's chance.<br/> <br/> So the current status is that<br/> - if I log in via ssh from my iMac, the ulimit -r result is what we want<br/> - if I try from a terminal running via the VNC desktop, it is not what we want.<br/> - if Squeak is run within a systemd file, it works by virtue of the LimitRTPRIO=2 command<br/> <br/> The system is x64 xubuntu with tigerVNC added. It may be of note that tigerVNC is running from a systemd file and that it seems to stop occasionally and require a manual restart. <br/> <br/> tim<br/> --<br/> tim Rowledge; <a target="_blank" class="defaultMailLink" href="mailto:tim@rowledge.org">tim@rowledge.org</a>; <a target="_blank" class="defaultMailLink" href="http://www.rowledge.org/tim">http://www.rowledge.org/tim</a><br/> Useful random insult:- Full of wisdumb.<br/> <br/> <br/> <br/> <br/></blockquote> <br/><br/>tim<br/>--<br/>tim Rowledge; <a target="_blank" class="defaultMailLink" href="mailto:tim@rowledge.org">tim@rowledge.org</a>; <a target="_blank" class="defaultMailLink" href="http://www.rowledge.org/tim">http://www.rowledge.org/tim</a><br/>Strange OpCodes: SEOB: Set Every Other Bit</pre></blockquote></div>