diff -up sudo-1.8.6p3/src/exec.c.nprocfix sudo-1.8.6p3/src/exec.c

--- sudo-1.8.6p3/src/exec.c.nprocfix	2013-07-11 12:55:10.686308050 +0200

+++ sudo-1.8.6p3/src/exec.c	2013-07-11 12:54:21.159160553 +0200

@@ -132,6 +132,15 @@ static int fork_cmnd(struct command_deta

     if (policy_init_session(details) != true)

 	errorx(1, _("policy plugin failed session initialization"));

+    /*

+     * See the comment in unlimit_nproc. It is important to call

+     * this function AFTER policy_init_session, because the PAM

+     * subsystem, if used, may change the RLIMIT_NPROC limit to

+     * unlimited (infinity) and we would not be able to distinguish

+     * between our temporary change and the change done by PAM.

+     */

+    unlimit_nproc();

+

     cmnd_pid = sudo_debug_fork();

     switch (cmnd_pid) {

     case -1:

diff -up sudo-1.8.6p3/src/exec_pty.c.nprocfix sudo-1.8.6p3/src/exec_pty.c

--- sudo-1.8.6p3/src/exec_pty.c.nprocfix	2012-09-18 15:57:43.000000000 +0200

+++ sudo-1.8.6p3/src/exec_pty.c	2013-07-11 12:37:41.811202301 +0200

@@ -678,6 +678,15 @@ fork_pty(struct command_details *details

 	errorx(1, _("policy plugin failed session initialization"));

     /*

+     * See the comment in unlimit_nproc. It is important to call

+     * this function AFTER policy_init_session, because the PAM

+     * subsystem, if used, may change the RLIMIT_NPROC limit to

+     * unlimited (infinity) and we would not be able to distinguish

+     * between our temporary change and the change done by PAM.

+     */

+    unlimit_nproc();

+

+    /*

      * Block some signals until cmnd_pid is set in the parent to avoid a

      * race between exec of the command and receipt of a fatal signal from it.

      */

diff -up sudo-1.8.6p3/src/sudo.c.nprocfix sudo-1.8.6p3/src/sudo.c

--- sudo-1.8.6p3/src/sudo.c.nprocfix	2013-07-11 12:37:41.767202170 +0200

+++ sudo-1.8.6p3/src/sudo.c	2013-07-11 12:37:41.811202301 +0200

@@ -808,25 +808,11 @@ sudo_check_suid(const char *path)

 static void

 disable_coredumps(void)

 {

-#if defined(__linux__) || defined(RLIMIT_CORE)

-    struct rlimit rl;

+#if defined(RLIMIT_CORE)

+		struct rlimit rl;

 #endif

     debug_decl(disable_coredumps, SUDO_DEBUG_UTIL)

-#if defined(__linux__)

-    /*

-     * Unlimit the number of processes since Linux's setuid() will

-     * apply resource limits when changing uid and return EAGAIN if

-     * nproc would be violated by the uid switch.

-     */

-    (void) getrlimit(RLIMIT_NPROC, &nproclimit);

-    rl.rlim_cur = rl.rlim_max = RLIM_INFINITY;

-    if (setrlimit(RLIMIT_NPROC, &rl)) {

-	memcpy(&rl, &nproclimit, sizeof(struct rlimit));

-	rl.rlim_cur = rl.rlim_max;

-	(void)setrlimit(RLIMIT_NPROC, &rl);

-    }

-#endif /* __linux__ */

 #ifdef RLIMIT_CORE

     /*

      * Turn off core dumps?

@@ -841,6 +827,28 @@ disable_coredumps(void)

     debug_return;

 }

+void

+unlimit_nproc(void)

+{

+	debug_decl(unlimit_nproc, SUDO_DEBUG_UTIL)

+#if defined(__linux__)

+		struct rlimit rl;

+	/*

+    * Unlimit the number of processes since Linux's setuid() will

+    * apply resource limits when changing uid and return EAGAIN if

+    * nproc would be violated by the uid switch.

+    */

+	(void) getrlimit(RLIMIT_NPROC, &nproclimit);

+	rl.rlim_cur = rl.rlim_max = RLIM_INFINITY;

+	if (setrlimit(RLIMIT_NPROC, &rl)) {

+		memcpy(&rl, &nproclimit, sizeof(struct rlimit));

+		rl.rlim_cur = rl.rlim_max;

+		(void)setrlimit(RLIMIT_NPROC, &rl);

+	}

+#endif /* __linux__ */

+	debug_return;

+}

+

 #ifdef HAVE_PROJECT_H

 static void

 set_project(struct passwd *pw)

@@ -1082,7 +1090,6 @@ exec_setup(struct command_details *detai

 	errno = 0;

 	l = sysconf(_SC_CHILD_MAX);

 	if (l == -1 && errno == 0 && getrlimit(RLIMIT_NPROC, &rl) == 0) {

-	    if (rl.rlim_cur == RLIM_INFINITY && rl.rlim_max == RLIM_INFINITY)

 		(void) setrlimit(RLIMIT_NPROC, &nproclimit);

 	}

     }

diff -up sudo-1.8.6p3/src/sudo.h.nprocfix sudo-1.8.6p3/src/sudo.h

--- sudo-1.8.6p3/src/sudo.h.nprocfix	2013-07-11 12:37:41.768202173 +0200

+++ sudo-1.8.6p3/src/sudo.h	2013-07-11 12:37:41.811202301 +0200

@@ -219,6 +219,7 @@ int policy_init_session(struct command_d

 int run_command(struct command_details *details);

 extern const char *list_user, *runas_user, *runas_group;

 extern struct user_details user_details;

+void unlimit_nproc(void);

 /* sudo_edit.c */

 int sudo_edit(struct command_details *details);