Bug 1102484

The limit set for Nova processes may be exceeded in very large deployments. Then a problem may occur where you get AVC denials for sys_resource and sys_admin while running Nova. For example: avc: denied { sys_admin } for pid=16497 comm="iptables-save" capability=21 scontext=unconfined_u:system_r:iptables_t:s0 tcontext=unconfined_u:system_r:iptables_t:s0 tclass=capability Due to the way process inheritance is set up on Linux, calling sudo inherits the caller's ulimit. Processes owned by the new UID are counted against the inherited ulimit. Transitioning to the iptables domain drops the ability to break the soft ulimit for number of processes, which causes iptables commands to fail in certain cases. Currently the limit to the number of processes is set to 2048 for the Nova user. While this limit should work for most installations, very large deployments may need a workaround. The workaround is to increase the limit by editing the /etc/security/limits.d/91-nova.conf file. For example, change: nova soft nproc 2048 to: nova soft nproc 4096