5

yep, i know that question was asked many times, but unfortunately i didn't find the complete answer on it.

so, how to limit the number of simultaneous processes per user?

i found two solutions:

  1. using pam_limits. in that case i need to configure /etc/security/limits.conf file. unfortunately, this solution works only for pam aware applications, that is it's not universal.

  2. using ulimit called from $HOME/profile. unfortunately it doens't work in all cases too. i tried to set "ulimit -u 100" and then launched in the same shell "stress --vm 200 --vm--bytes 100". application was successfully launched and i got more than 200 processes under user root.

i need to build a robust system, so solutions which work only in some cases are inappropriate.

Improve this question

3 Answers 3

Reset to default
2

A kernel security patch grsecurity has a feature called Enforce RLMIT_NPROC on execs. When enabled, it enforces per-user limits to be system-wide instead of per-login (or worse, as you have observed).

Improve this answer
3
  • For 3.* kernels grsecurity is on test stage, so we will give it a chance in our next release. Thanks or advice.
    – OJ278
    May 15, 2012 at 7:28
  • Have you tried it on production servers?
    – OJ278
    May 15, 2012 at 7:28
  • Yes, in the past grsecurity was a great success for me in a quite large mail/web service. And grsecurity web site tells us this: grsecurity in the news: Microsoft/Skype run grsecurity on 10,000 supernodes (May 1 2012)
    – Janne Pikkarainen
    May 15, 2012 at 8:13
0

In the same shell it will not work. Try to put the ulimit setting in you .bashrc of root, login as root again and try. You can verify with ulimit -a to verify.

Improve this answer
0

You can set up limits in /etc/security/limits.conf

Improve this answer
2
  • it doesn't work everywhere because /etc/security/limits.conf is for PAM aware applications only.
    – OJ278
    May 15, 2012 at 7:09
  • Also /etc/login.conf in BSDs. I don't believe either of these are PAM only, but could be mistaken.
    – bab
    May 24, 2012 at 3:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .