Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

On CentOS 6.4 / 64 bit - how to find the limits of the user "nobody"?

Because I can not just su - nobody and call ulimit -a:

# id nobody
uid=99(nobody) gid=99(nobody) groups=99(nobody)

# su - nobody
This account is currently not available.

UPDATE:

I am asking: how to call ulimit -a for the CentOS user nobody, so that I can adjust /etc/security/limits.conf in regard to the max number of open files for that user.

EVEN MORE DETAILS:

I have a perl script (a non-forking TCP-sockets based card game daemon) which is being started by init (I've created a file for it: /etc/init/my_card_game.conf), but then drops super user privilleges and runs as nobody:

sub drop_privs {
        my ($uid, $gid) = (getpwnam('nobody'))[2, 3];
        die "User nobody not found\n" unless $uid && $gid;

        umask(0);
        chdir('/tmp') or die "Can not chdir to /tmp: $!\n";
        #chroot('/tmp') or die "Can not chroot to /tmp: $!\n";

        # try to set the real, effective and save uid
        setgid($gid) or die "Can not set gid to $gid: $!\n";
        setuid($uid) or die "Can not set uid to $uid: $!\n";
        # try to regain privileges - this should fail
        die "Not able to drop privileges\n" if setuid(0) || setgid(0);
}

I want to make sure it has a big enough max number of nofiles - so that it can serve all connected clients.

share|improve this question
    
You are asking how to figure out something that does not exist. There no limits of a user. Only processes have limits. As you know, what limits a process gets doesn't depend entirely on its user but on how the process is created. –  David Schwartz Jul 17 '13 at 11:39
    
I am asking: how to call "ulimit -a" for the CentOS user "nobody" –  Alexander Farber Jul 17 '13 at 11:50
    
You can't. Users don't have ulimits. Only processes do. What ulimit a process owned by "nobody" will have depends on how it is created, as (it seems) you already knew when you asked the question. –  David Schwartz Jul 17 '13 at 11:51
    
@DavidSchwartz: You can very much limit a user, e.g. to a total amount of processes. This limits are displayed by ulimit and are not tied to a process, but a user. –  SvW Jul 17 '13 at 12:03
    
@SvW: The limits displayed by ulimit are the limits of the current process. –  David Schwartz Jul 17 '13 at 12:07

1 Answer 1

up vote 0 down vote accepted

The limits must be raised before privileges are dropped since privileges are needed to raise hard resource limits. You can add code to your script to do it. But the easiest way is to make a shell script that launches your perl script. The shell script can use ulimit since it will still have privileges. (Users have nothing to do with this. Resource limits are attributes of processes.)

share|improve this answer
    
What about the file /etc/security/limits.conf doesn't it describe limits for users? –  Alexander Farber Jul 17 '13 at 12:14
1  
No. It describes limits for login sessions -- groups of processes. Sometimes the distinction isn't important, so we can afford to be imprecise. But this question shows how that can lead people astray. –  David Schwartz Jul 17 '13 at 12:18
    
What happens when I call su - postgres (that user has a login shell) and ulimit -a? I can see the limits for that user –  Alexander Farber Jul 17 '13 at 12:48
1  
You can see the limits for the login session. If they were the limits for the user, you would also see them if you don't use the - parameter to su since the user would be the same. The limits on a process (or login session, depending on which limit we're talking about) are determined by how that process was created. It inherits its parent's limits, if privileged it can raise them, and it can lower them if it chooses. –  David Schwartz Jul 17 '13 at 12:48
    
So for my perl daemon, should I set the nofiles in /etc/init/my_game.conf or in /etc/security/limits.d/90-nproc.conf? –  Alexander Farber Jul 17 '13 at 12:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.