Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

yep, i know that question was asked many times, but unfortunately i didn't find the complete answer on it.

so, how to limit the number of simultaneous processes per user?

i found two solutions:

  1. using pam_limits. in that case i need to configure /etc/security/limits.conf file. unfortunately, this solution works only for pam aware applications, that is it's not universal.

  2. using ulimit called from $HOME/profile. unfortunately it doens't work in all cases too. i tried to set "ulimit -u 100" and then launched in the same shell "stress --vm 200 --vm--bytes 100". application was successfully launched and i got more than 200 processes under user root.

i need to build a robust system, so solutions which work only in some cases are inappropriate.

share|improve this question
add comment

3 Answers

up vote 2 down vote accepted

A kernel security patch grsecurity has a feature called Enforce RLMIT_NPROC on execs. When enabled, it enforces per-user limits to be system-wide instead of per-login (or worse, as you have observed).

share|improve this answer
    
For 3.* kernels grsecurity is on test stage, so we will give it a chance in our next release. Thanks or advice. –  OJ278 May 15 '12 at 7:28
    
Have you tried it on production servers? –  OJ278 May 15 '12 at 7:28
    
Yes, in the past grsecurity was a great success for me in a quite large mail/web service. And grsecurity web site tells us this: grsecurity in the news: Microsoft/Skype run grsecurity on 10,000 supernodes (May 1 2012) –  Janne Pikkarainen May 15 '12 at 8:13
add comment

In the same shell it will not work. Try to put the ulimit setting in you .bashrc of root, login as root again and try. You can verify with ulimit -a to verify.

share|improve this answer
add comment

You can set up limits in /etc/security/limits.conf

share|improve this answer
    
it doesn't work everywhere because /etc/security/limits.conf is for PAM aware applications only. –  OJ278 May 15 '12 at 7:09
    
Also /etc/login.conf in BSDs. I don't believe either of these are PAM only, but could be mistaken. –  bab May 24 '12 at 3:44
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.