What is the difference between 'login: root' and 'su -' ?

What is the difference between 'login: root' and 'su -' ?

[Peter Seiderer]

Hello,
tried today to mkfs.ext2 a partition of my disk and detected there is
a little difference between 'login: root' and 'su -'.

First I tried it this way:

	Welcome to SuSE Linux 7.0 (i386) - Kernel 2.4.14 (tty1).

	zodiak login: seiderer
	Password:
	seiderer@zodiak:~ > su -
	Password:
	zodiak:~ #
	zodiak:~ # mkfs.ext2 /dev/hdc4
	mke2fs 1.18, 11-Nov-1999 for EXT2 FS 0.5b, 95/08/09
	Filesystem label=
	OS type: Linux
	Block size=4096 (log=2)
	Fragment size=4096 (log=2)
	716672 inodes, 1432116 blocks
	71605 blocks (5.00%) reserved for the super user
	First data block=0
	44 block groups
	32768 blocks per group, 32768 fragments per group
	16288 inodes per group
	Superblock backups stored on blocks:
	        32768, 98304, 163840, 229376, 294912, 819200, 884736

	Writing inode tables: 16/44File size limit exceeded

strace showed that write returned wit EFBIG and the process ended with SIGXFSZ:

	write(1, "\10\10\10\10\10", 5)          = 5
	write(1, "16/44", 5)                    = 5
	_llseek(4, 18446744071562084352, [2147500032], SEEK_SET) = 0
	write(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 32768) = -1 EFBIG (File too large)
	--- SIGXFSZ (File size limit exceeded) ---
	+++ killed by SIGXFSZ +++

When login in directly from the console as root everything went right:
	Welcome to SuSE Linux 7.0 (i386) - Kernel 2.4.14 (tty1).

	zodiak login: root
	Password:
	zodiak:~ # mkfs.ext2 /dev/hdc4
	mke2fs 1.18, 11-Nov-1999 for EXT2 FS 0.5b, 95/08/09
	Filesystem label=
	OS type: Linux
	Block size=4096 (log=2)
	Fragment size=4096 (log=2)
	716672 inodes, 1432116 blocks
	71605 blocks (5.00%) reserved for the super user
	First data block=0
	44 block groups
	32768 blocks per group, 32768 fragments per group
	16288 inodes per group
	Superblock backups stored on blocks:
	        32768, 98304, 163840, 229376, 294912, 819200, 884736

	Writing inode tables: done
	Writing superblocks and filesystem accounting information: done
	zodiak:~ #

The RLIMIT_FSIZE showed in both cases the same values:
getrlimit(RLIMIT_FSIZE) rlim_cur: 2147483647 rlim_max: 2147483647

Can anybody point me out what went wrong? Is it a kernel limit?

Peter

Re: What is the difference between 'login: root' and 'su -' ?

[Peter Seiderer]

Mhhh,
the strace output from the 'login: root' one (the one which was good)
looks the same till the EFBIG place:

	write(1, "\10\10\10\10\10", 5)          = 5
	write(1, "16/44", 5)                    = 5
	_llseek(4, 18446744071562084352, [2147500032], SEEK_SET) = 0
	write(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 32768) = 32768
	_llseek(4, 18446744071562117120, [2147532800], SEEK_SET) = 0
	write(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 32768) = 32768
	_llseek(4, 18446744071562149888, [2147565568], SEEK_SET) = 0
	write(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 32768) = 32768
	_llseek(4, 18446744071562182656, [2147598336], SEEK_SET) = 0
	write(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 32768) = 32768

Peter

On Wed, Nov 07, 2001 at 10:48:24PM +0200, Ville Herva wrote:
> On Wed, Nov 07, 2001 at 06:47:10PM +0100, you [Peter Seiderer] claimed:
> > Hello,
> > tried today to mkfs.ext2 a partition of my disk and detected there is
> > a little difference between 'login: root' and 'su -'.
> > 
> > First I tried it this way:
> > 
> > 	Welcome to SuSE Linux 7.0 (i386) - Kernel 2.4.14 (tty1).
> > 
> > 	zodiak login: seiderer
> > 	Password:
> > 	seiderer@zodiak:~ > su -
> > 	Password:
> > 	zodiak:~ #
> > 	zodiak:~ # mkfs.ext2 /dev/hdc4
> > 	mke2fs 1.18, 11-Nov-1999 for EXT2 FS 0.5b, 95/08/09
> > 	Filesystem label=
> > 	OS type: Linux
> > 	Block size=4096 (log=2)
> > 	Fragment size=4096 (log=2)
> > 	716672 inodes, 1432116 blocks
> > 	71605 blocks (5.00%) reserved for the super user
> > 	First data block=0
> > 	44 block groups
> > 	32768 blocks per group, 32768 fragments per group
> > 	16288 inodes per group
> > 	Superblock backups stored on blocks:
> > 	        32768, 98304, 163840, 229376, 294912, 819200, 884736
> > 
> > 	Writing inode tables: 16/44File size limit exceeded
> > 
> > strace showed that write returned wit EFBIG and the process ended with SIGXFSZ:
> > 
> > 	write(1, "\10\10\10\10\10", 5)          = 5
> > 	write(1, "16/44", 5)                    = 5
> > 	_llseek(4, 18446744071562084352, [2147500032], SEEK_SET) = 0
> > 	write(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 32768) = -1 EFBIG (File too large)
> > 	--- SIGXFSZ (File size limit exceeded) ---
> > 	+++ killed by SIGXFSZ +++
> 
> Hmm, 18446744071562084352 = 0xffffffff80004000, 2147500032 = 0x80004000...
> It looks a tad like llseek's offset_high would have been corrupted...
> Strange.
> 
> 1432116 blocks * 4096 bytes/block * 16/44 written = 2133071685.81818 so
> 2147500032 looks sane(ish).
> 
> 
> -- v --
> 
> v@iki.fi

Re: What is the difference between 'login: root' and 'su -' ?

[Peter Seiderer]

Hello,
in both cases file descriptor 4 is from 'open("/dev/hdc4", O_RDWR) = 4'  ....
Peter

On Thu, Nov 08, 2001 at 08:10:07AM +0200, Ville Herva wrote:
> On Wed, Nov 07, 2001 at 11:40:25PM +0100, you [Peter Seiderer] claimed:
> > Mhhh,
> > the strace output from the 'login: root' one (the one which was good)
> > looks the same till the EFBIG place:
> > 
> > 	write(1, "\10\10\10\10\10", 5)          = 5
> > 	write(1, "16/44", 5)                    = 5
> > 	_llseek(4, 18446744071562084352, [2147500032], SEEK_SET) = 0
> > 	write(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 32768) = 32768
> > 	_llseek(4, 18446744071562117120, [2147532800], SEEK_SET) = 0
> > 	write(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 32768) = 32768
> > 	_llseek(4, 18446744071562149888, [2147565568], SEEK_SET) = 0
> > 	write(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 32768) = 32768
> > 	_llseek(4, 18446744071562182656, [2147598336], SEEK_SET) = 0
> > 	write(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 32768) = 32768
> 
> Weird. Perhaps strace gets that wrong and the problem is elsewhere.
> 
> Did you make sure that fd 4 is the same _partition_ in both cases (using
> strace)? The only thing I could imagine exposing 2GB limit is writing to a
> file.
> 
> > > > 	zodiak login: seiderer
> > > > 	Password:
> > > > 	seiderer@zodiak:~ > su -
> > > > 	Password:
> > > > 	zodiak:~ #
> > > > 	zodiak:~ # mkfs.ext2 /dev/hdc4
> > > > 	mke2fs 1.18, 11-Nov-1999 for EXT2 FS 0.5b, 95/08/09
> > > > 	Filesystem label=
> > > > 	OS type: Linux
> > > > 	Block size=4096 (log=2)
> > > > 	Fragment size=4096 (log=2)
> > > > 	716672 inodes, 1432116 blocks
> > > > 	71605 blocks (5.00%) reserved for the super user
> > > > 	First data block=0
> > > > 	44 block groups
> > > > 	32768 blocks per group, 32768 fragments per group
> > > > 	16288 inodes per group
> > > > 	Superblock backups stored on blocks:
> > > > 	        32768, 98304, 163840, 229376, 294912, 819200, 884736
> > > > 
> > > > 	Writing inode tables: 16/44File size limit exceeded
> > > > 
> > > > strace showed that write returned wit EFBIG and the process ended with SIGXFSZ:
> > > > 
> > > > 	write(1, "\10\10\10\10\10", 5)          = 5
> > > > 	write(1, "16/44", 5)                    = 5
> > > > 	_llseek(4, 18446744071562084352, [2147500032], SEEK_SET) = 0
> > > > 	write(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 32768) = -1 EFBIG (File too large)
> > > > 	--- SIGXFSZ (File size limit exceeded) ---
> > > > 	+++ killed by SIGXFSZ +++
> > > 
> > > Hmm, 18446744071562084352 = 0xffffffff80004000, 2147500032 = 0x80004000...
> > > It looks a tad like llseek's offset_high would have been corrupted...
> > > Strange.
> > > 
> > > 1432116 blocks * 4096 bytes/block * 16/44 written = 2133071685.81818 so
> > > 2147500032 looks sane(ish).
> 
> -- v --
> 
> v@iki.fi

Re: What is the difference between 'login: root' and 'su -' ?

[Peter Seiderer]

Hello,
first thank you for your effort.

Did the diff: nearly no difference till the failure point (only pid, time etc.).
Peter

On Thu, Nov 08, 2001 at 10:46:34AM +0200, Ville Herva wrote:
> On Thu, Nov 08, 2001 at 09:46:37AM +0100, you [Peter Seiderer] claimed:
> > Hello,
> > in both cases file descriptor 4 is from 'open("/dev/hdc4", O_RDWR) = 4'  ....
> > Peter
> 
> Well, beats me. Sorry I wasn't much of a help...
> 
> One thing you could try is to capture the strace output of both sessions up
> to the point where the 'su -' one fails. Then do a diff for those logs and
> see if anything suspicios differs. Not much _should_ differ, I reckon...
> 
> 
> -- v --
> 
> v@iki.fi

-- 
------------------------------------------------------------------------
Peter Seiderer                     E-Mail:  Peter.Seiderer@ciselant.de
(Diplom-Informatiker Univ.)                   (PGP-key available)
Holzstr. 13                        WWW   :  http://www.ciselant.de
D-80469 Muenchen                   Phone :  +49 (0)89 - 69380934
------------------------------------------------------------------------

Re: What is the difference between 'login: root' and 'su -' ?

[Peter Seiderer]

Hello,
the SIGXFSZ signal is produced in the file mm/filemap.c (linx-2.4.14) in
line 2771:

2769:	if (limit != RLIM_INFINITY) {
2770:		if (pos >= limit) {
2771:			send_sig(SIGXFSZ, current, 0);
2772:			goto out;
2773:		}

The valus at this point are
limit:         0x7fffffff
RLIM_INFINITY: 0xffffffff
pos:           0x80004000

where limit comes from:
unsigned long	limit = current->rlim[RLIMIT_FSIZE].rlim_cur;

but I did not yet detected the point(s) where
current->rlim[RLIMIT_FSIZE].rlim_cur
is(are) set/changed.
Peter

On Thu, Nov 08, 2001 at 11:13:30AM +0200, Ville Herva wrote:
> On Thu, Nov 08, 2001 at 10:00:14AM +0100, you [Peter Seiderer] claimed:
> > Hello,
> > first thank you for your effort.
> > 
> > Did the diff: nearly no difference till the failure point (only pid, time
> > etc.). Peter
> 
> And there really are no resource limits nor quota?
> 
> At this point you'll propably have to dig into glibc / kernel source and try
> to find out what might cause that...
> 
> 
> -- v --
> 

[patch] Re: What is the difference between 'login: root' and 'su -' ?

[Peter Seiderer]

[-- Attachment #1: Type: text/plain, Size: 1156 bytes --]

On Thu, Nov 08, 2001 at 11:14:21AM +0100, Peter Seiderer wrote:
> Hello,
> the SIGXFSZ signal is produced in the file mm/filemap.c (linx-2.4.14) in
> line 2771:
> 
> 2769:	if (limit != RLIM_INFINITY) {
> 2770:		if (pos >= limit) {
> 2771:			send_sig(SIGXFSZ, current, 0);
> 2772:			goto out;
> 2773:		}
> 
> The valus at this point are
> limit:         0x7fffffff
> RLIM_INFINITY: 0xffffffff
> pos:           0x80004000
> 
> where limit comes from:
> unsigned long	limit = current->rlim[RLIMIT_FSIZE].rlim_cur;
> 
> but I did not yet detected the point(s) where
> current->rlim[RLIMIT_FSIZE].rlim_cur
> is(are) set/changed.
> Peter
> 

Investigated a litte bit in the kernel I detected there is a
sys_getrlimit function and a sys_old_getrlimit function which is
called in arch i386, m68k, sh, ppc, s390, cris, arm which mangles the
RLIM_INFINITY: 0xffffffff to 0x7fffffff.

The problem is that it is now impossible to set the limits to
RLIM_INFINITY while only 0x7fffffff is given as input.

Therefor I programed analog to sys_old_getrlimit the function sys_old_setrlimit
which mangles all values >= 0x7fffffff to 0xffffffff (see attached patch).

Peter



[-- Attachment #2: patch_RLIM_INFINITY --]
[-- Type: text/plain, Size: 5195 bytes --]

diff -ru linux-2.4.14_orig/arch/arm/kernel/calls.S linux-2.4.14/arch/arm/kernel/calls.S
--- linux-2.4.14_orig/arch/arm/kernel/calls.S	Mon Oct  8 19:39:18 2001
+++ linux-2.4.14/arch/arm/kernel/calls.S	Thu Nov  8 14:48:58 2001
@@ -89,7 +89,7 @@
 		.long	SYMBOL_NAME(sys_sigsuspend_wrapper)
 		.long	SYMBOL_NAME(sys_sigpending)
 		.long	SYMBOL_NAME(sys_sethostname)
-/* 75 */	.long	SYMBOL_NAME(sys_setrlimit)
+/* 75 */	.long	SYMBOL_NAME(sys_old_setrlimit)
 		.long	SYMBOL_NAME(sys_old_getrlimit)
 		.long	SYMBOL_NAME(sys_getrusage)
 		.long	SYMBOL_NAME(sys_gettimeofday)
diff -ru linux-2.4.14_orig/arch/cris/kernel/entry.S linux-2.4.14/arch/cris/kernel/entry.S
--- linux-2.4.14_orig/arch/cris/kernel/entry.S	Mon Oct  8 20:43:54 2001
+++ linux-2.4.14/arch/cris/kernel/entry.S	Thu Nov  8 14:48:40 2001
@@ -833,7 +833,7 @@
 	.long SYMBOL_NAME(sys_sigsuspend)
 	.long SYMBOL_NAME(sys_sigpending)
 	.long SYMBOL_NAME(sys_sethostname)
-	.long SYMBOL_NAME(sys_setrlimit)	/* 75 */
+	.long SYMBOL_NAME(sys_old_setrlimit)	/* 75 */
 	.long SYMBOL_NAME(sys_old_getrlimit)
 	.long SYMBOL_NAME(sys_getrusage)
 	.long SYMBOL_NAME(sys_gettimeofday)
diff -ru linux-2.4.14_orig/arch/i386/kernel/entry.S linux-2.4.14/arch/i386/kernel/entry.S
--- linux-2.4.14_orig/arch/i386/kernel/entry.S	Sat Nov  3 02:18:49 2001
+++ linux-2.4.14/arch/i386/kernel/entry.S	Thu Nov  8 13:57:47 2001
@@ -471,7 +471,7 @@
 	.long SYMBOL_NAME(sys_sigsuspend)
 	.long SYMBOL_NAME(sys_sigpending)
 	.long SYMBOL_NAME(sys_sethostname)
-	.long SYMBOL_NAME(sys_setrlimit)	/* 75 */
+	.long SYMBOL_NAME(sys_old_setrlimit)	/* 75 */
 	.long SYMBOL_NAME(sys_old_getrlimit)
 	.long SYMBOL_NAME(sys_getrusage)
 	.long SYMBOL_NAME(sys_gettimeofday)
diff -ru linux-2.4.14_orig/arch/m68k/kernel/entry.S linux-2.4.14/arch/m68k/kernel/entry.S
--- linux-2.4.14_orig/arch/m68k/kernel/entry.S	Mon Oct  8 19:39:18 2001
+++ linux-2.4.14/arch/m68k/kernel/entry.S	Thu Nov  8 14:46:53 2001
@@ -500,7 +500,7 @@
 	.long SYMBOL_NAME(sys_sigsuspend)
 	.long SYMBOL_NAME(sys_sigpending)
 	.long SYMBOL_NAME(sys_sethostname)
-	.long SYMBOL_NAME(sys_setrlimit)	/* 75 */
+	.long SYMBOL_NAME(sys_old_setrlimit)	/* 75 */
 	.long SYMBOL_NAME(sys_old_getrlimit)
 	.long SYMBOL_NAME(sys_getrusage)
 	.long SYMBOL_NAME(sys_gettimeofday)
diff -ru linux-2.4.14_orig/arch/ppc/kernel/misc.S linux-2.4.14/arch/ppc/kernel/misc.S
--- linux-2.4.14_orig/arch/ppc/kernel/misc.S	Sat Nov  3 02:43:54 2001
+++ linux-2.4.14/arch/ppc/kernel/misc.S	Thu Nov  8 14:47:54 2001
@@ -988,7 +988,7 @@
 	.long sys_sigsuspend
 	.long sys_sigpending
 	.long sys_sethostname
-	.long sys_setrlimit	/* 75 */
+	.long sys_old_setrlimit	/* 75 */
 	.long sys_old_getrlimit
 	.long sys_getrusage
 	.long sys_gettimeofday
diff -ru linux-2.4.14_orig/arch/s390/kernel/entry.S linux-2.4.14/arch/s390/kernel/entry.S
--- linux-2.4.14_orig/arch/s390/kernel/entry.S	Thu Oct 11 18:04:57 2001
+++ linux-2.4.14/arch/s390/kernel/entry.S	Thu Nov  8 14:48:24 2001
@@ -442,7 +442,7 @@
         .long  sys_sigsuspend_glue
         .long  sys_sigpending
         .long  sys_sethostname
-        .long  sys_setrlimit            /* 75 */
+        .long  sys_old_setrlimit            /* 75 */
         .long  sys_old_getrlimit
         .long  sys_getrusage
         .long  sys_gettimeofday
diff -ru linux-2.4.14_orig/arch/sh/kernel/entry.S linux-2.4.14/arch/sh/kernel/entry.S
--- linux-2.4.14_orig/arch/sh/kernel/entry.S	Mon Oct  8 19:39:18 2001
+++ linux-2.4.14/arch/sh/kernel/entry.S	Thu Nov  8 14:47:13 2001
@@ -1151,7 +1151,7 @@
 	.long SYMBOL_NAME(sys_sigsuspend)
 	.long SYMBOL_NAME(sys_sigpending)
 	.long SYMBOL_NAME(sys_sethostname)
-	.long SYMBOL_NAME(sys_setrlimit)	/* 75 */
+	.long SYMBOL_NAME(sys_old_setrlimit)	/* 75 */
 	.long SYMBOL_NAME(sys_old_getrlimit)
 	.long SYMBOL_NAME(sys_getrusage)
 	.long SYMBOL_NAME(sys_gettimeofday)
diff -ru linux-2.4.14_orig/kernel/sys.c linux-2.4.14/kernel/sys.c
--- linux-2.4.14_orig/kernel/sys.c	Tue Sep 18 23:10:43 2001
+++ linux-2.4.14/kernel/sys.c	Thu Nov  8 14:54:11 2001
@@ -1133,6 +1133,39 @@
 	return 0;
 }
 
+#if !defined(__ia64__)
+
+/*
+ *	Analog to sys_old_getrlimit the back compatibility for setrlimit.
+ */
+
+asmlinkage long sys_old_setrlimit(unsigned int resource, struct rlimit *rlim)
+{
+        struct rlimit new_rlim, *old_rlim;
+
+        if (resource >= RLIM_NLIMITS)
+                return -EINVAL;
+        if(copy_from_user(&new_rlim, rlim, sizeof(*rlim)))
+                return -EFAULT;
+        old_rlim = current->rlim + resource;
+        if (((new_rlim.rlim_cur > old_rlim->rlim_max) ||
+             (new_rlim.rlim_max > old_rlim->rlim_max)) &&
+            !capable(CAP_SYS_RESOURCE))
+                return -EPERM;
+        if (resource == RLIMIT_NOFILE) {
+                if (new_rlim.rlim_cur > NR_OPEN || new_rlim.rlim_max > NR_OPEN)
+                        return -EPERM;
+        }
+	if (new_rlim.rlim_cur >= 0x7FFFFFFF)
+		new_rlim.rlim_cur = RLIM_INFINITY;
+	if (new_rlim.rlim_max >= 0x7FFFFFFF)
+		new_rlim.rlim_max = RLIM_INFINITY;
+        *old_rlim = new_rlim;
+        return 0;
+}
+
+#endif
+
 /*
  * It would make sense to put struct rusage in the task_struct,
  * except that would make the task_struct be *really big*.  After

Re: What is the difference between 'login: root' and 'su -' ?

[Vitezslav Samel]

On Wed, Nov 07, 2001 at 06:47:10PM +0100, Peter Seiderer wrote:
> Hello,
> tried today to mkfs.ext2 a partition of my disk and detected there is
> a little difference between 'login: root' and 'su -'.

[snip]

> The RLIMIT_FSIZE showed in both cases the same values:
> getrlimit(RLIMIT_FSIZE) rlim_cur: 2147483647 rlim_max: 2147483647
> 
> Can anybody point me out what went wrong? Is it a kernel limit?

  I had similar problems. The root of all evil was ulimit in bash. After
compiling bash against the new glibc and kernel headers, all was O.K.
(the bad bash was instaled in kernel-2.2 times). So check if you have the
latest versions of kernel, glibc, e2fsprogs and bash (maybe others)
recompiled.

	Cheers,
		Vita

Re: What is the difference between 'login: root' and 'su -' ?

[Tobias Diedrich]

Peter Seiderer wrote:
> Hello,
> tried today to mkfs.ext2 a partition of my disk and detected there is
> a little difference between 'login: root' and 'su -'.
[...]
> 	--- SIGXFSZ (File size limit exceeded) ---
> 	+++ killed by SIGXFSZ +++

I ran into the same Problem in SuSE 7.0 .
Turned out it was pam_limits.so , try if it works if you comment out the
line with pam_limits.so in it in /etc/pam.d/su .
You probably have to recompile the pam libraries.

-- 
Tobias								PGP: 0x9AC7E0BC

Re: What is the difference between 'login: root' and 'su -' ?

[Peter Seiderer]

On Thu, Nov 08, 2001 at 04:38:22PM +0100, Tobias Diedrich wrote:
> Peter Seiderer wrote:
> > Hello,
> > tried today to mkfs.ext2 a partition of my disk and detected there is
> > a little difference between 'login: root' and 'su -'.
> [...]
> > 	--- SIGXFSZ (File size limit exceeded) ---
> > 	+++ killed by SIGXFSZ +++
> 
> I ran into the same Problem in SuSE 7.0 .
> Turned out it was pam_limits.so , try if it works if you comment out the
> line with pam_limits.so in it in /etc/pam.d/su .
> You probably have to recompile the pam libraries.
> 
> -- 
> Tobias								PGP: 0x9AC7E0BC

There is no pam_limits line in my /etc/pam.d/su only in /etc/pam.d/login.
But commenting it out did not help.
Peter