journald: set a lower size limit for FDs from unpriv processes by bluca · Pull Request #40571 · systemd/systemd

bluca · 2026-02-05T00:42:25Z

Unprivileged processes can send 768M in a FD-based message to journald, which will be malloc'ed in one go, likely causing memory issues. Set the limit for unprivileged users to 24M.

Allow coredumps as an exception, since we always allowed storing up to the 768M max core files in the journal.

Reported on yeswehack.com as #YWH-PGM9780-48

poettering · 2026-02-05T08:54:27Z

would love it if this was configurable via env var. because if coredumps are submitted these will come in via unpriv connections, and thus this hardcoded logic would basically make it impossible to save coredumps in journal files, which we however officially support. hence, please make this configurable via env var, so that we at least can tell people that if they really want this, there is a way out without patching

bluca · 2026-02-05T08:59:38Z

Doesn't coredump run as root?

bluca · 2026-02-05T14:43:06Z

Ah yes it's sent as the user of the crashed process - I have changed it to check the context, and allow it if the sender is [email protected]. The core files limit can be set anyway with privileges, and the storage too, so it should be ok I think, and it avoids breaking compat.

yuwata · 2026-02-06T06:32:36Z

+                        log_ratelimit_warning_errno(r, JOURNAL_LOG_RATELIMIT,
+                                                    "Failed to retrieve credentials for PID " PID_FMT ", ignoring: %m",
+                                                    ucred->pid);
+                else if (context->unit && startswith(context->unit, "systemd-coredump@"))


This needs to be updated after #39287 is merged.

bluca · 2026-02-06T11:58:45Z

Ah yes it's sent as the user of the crashed process - I have changed it to check the context, and allow it if the sender is [email protected]. The core files limit can be set anyway with privileges, and the storage too, so it should be ok I think, and it avoids breaking compat.

I can still add an env var of course if you want it, if there's some other use case to enable

poettering · 2026-02-08T21:45:42Z

i still think there should be an env var for this knob

Unprivileged processes can send 768M in a FD-based message to journald, which will be malloc'ed in one go, likely causing memory issues. Set the limit for unprivileged users to 24M. Allow coredumps as an exception, since we always allowed storing up to the 768M max core files in the journal. Reported on yeswehack.com as #YWH-PGM9780-48

github-actions Bot added journal util-lib import please-review PR is ready for (re-)review by a maintainer labels Feb 5, 2026

yuwata requested changes Feb 5, 2026

View reviewed changes

Comment thread src/journal/journald-native.c Outdated

Comment thread src/shared/journal-importer.h Outdated

poettering added reviewed/needs-rework 🔨 PR has been reviewed and needs another round of reworks and removed please-review PR is ready for (re-)review by a maintainer labels Feb 5, 2026

bluca force-pushed the journal_user_blob_size branch from 838a71e to 96c1beb Compare February 5, 2026 14:42

bluca changed the title ~~journald: set a lower size limit for messages from unpriv processes~~ journald: set a lower size limit for FDs from unpriv processes Feb 5, 2026

github-actions Bot added please-review PR is ready for (re-)review by a maintainer and removed reviewed/needs-rework 🔨 PR has been reviewed and needs another round of reworks labels Feb 5, 2026

yuwata reviewed Feb 6, 2026

View reviewed changes

poettering reviewed Feb 8, 2026

View reviewed changes