1LIMITS.CONF(5) Linux-PAM Manual LIMITS.CONF(5)
2
6 limits.conf - configuration file for the pam_limits module
7
9 The pam_limits.so module applies ulimit limits, nice priority and
10 number of simultaneous login sessions limit to user login sessions.
11 This description of the configuration file syntax applies to the
12 /etc/security/limits.conf file and *.conf files in the
13 /etc/security/limits.d directory.
14 The syntax of the lines is as follows:
16 <domain><type><item><value>
18 The fields listed above should be filled as follows:
20 <domain>
22 · a username
24 · a groupname, with @group syntax. This should not be confused
26 with netgroups.
27 · the wildcard *, for default entry.
29 · the wildcard %, for maxlogins limit only, can also be used with
31 %group syntax. If the % wildcard is used alone it is identical
32 to using * with maxsyslogins limit. With a group specified
33 after % it limits the total number of logins of all users that
34 are member of the group.
35 · an uid range specified as <min_uid>:<max_uid>. If min_uid is
37 omitted, the match is exact for the max_uid. If max_uid is
38 omitted, all uids greater than or equal min_uid match.
39 · a gid range specified as @<min_gid>:<max_gid>. If min_gid is
41 omitted, the match is exact for the max_gid. If max_gid is
42 omitted, all gids greater than or equal min_gid match. For the
43 exact match all groups including the user's supplementary
44 groups are examined. For the range matches only the user's
45 primary group is examined.
46 · a gid specified as %:<gid> applicable to maxlogins limit only.
48 It limits the total number of logins of all users that are
49 member of the group with the specified gid.
50 <type>
52 hard
54 for enforcing hard resource limits. These limits are set by the
55 superuser and enforced by the Kernel. The user cannot raise his
56 requirement of system resources above such values.
57 soft
59 for enforcing soft resource limits. These limits are ones that
60 the user can move up or down within the permitted range by any
61 pre-existing hard limits. The values specified with this token
62 can be thought of as default values, for normal system usage.
63 -
65 for enforcing both soft and hard resource limits together.
66 Note, if you specify a type of '-' but neglect to supply the
68 item and value fields then the module will never enforce any
69 limits on the specified user/group etc. .
70 <item>
72 core
74 limits the core file size (KB)
75 data
77 maximum data size (KB)
78 fsize
80 maximum filesize (KB)
81 memlock
83 maximum locked-in-memory address space (KB)
84 nofile
86 maximum number of open file descriptors
87 rss
89 maximum resident set size (KB) (Ignored in Linux 2.4.30 and
90 higher)
91 stack
93 maximum stack size (KB)
94 cpu
96 maximum CPU time (minutes)
97 nproc
99 maximum number of processes
100 as
102 address space limit (KB)
103 maxlogins
105 maximum number of logins for this user (this limit does not
106 apply to user with uid=0)
107 maxsyslogins
109 maximum number of all logins on system; user is not allowed to
110 log-in if total number of all users' logins is greater than
111 specified number (this limit does not apply to user with uid=0)
112 priority
114 the priority to run user process with (negative values boost
115 process priority)
116 locks
118 maximum locked files (Linux 2.4 and higher)
119 sigpending
121 maximum number of pending signals (Linux 2.6 and higher)
122 msgqueue
124 maximum memory used by POSIX message queues (bytes) (Linux 2.6
125 and higher)
126 nice
128 maximum nice priority allowed to raise to (Linux 2.6.12 and
129 higher) values: [-20,19]
130 rtprio
132 maximum realtime priority allowed for non-privileged processes
133 (Linux 2.6.12 and higher)
134 All items support the values -1, unlimited or infinity indicating no
136 limit, except for priority and nice.
137 If a hard limit or soft limit of a resource is set to a valid value,
139 but outside of the supported range of the local system, the system may
140 reject the new limit or unexpected behavior may occur. If the control
141 value required is used, the module will reject the login if a limit
142 could not be set.
143 In general, individual limits have priority over group limits, so if
145 you impose no limits for admin group, but one of the members in this
146 group have a limits line, the user will have its limits set according
147 to this line.
148 Also, please note that all limit settings are set per login. They are
150 not global, nor are they permanent; existing only for the duration of
151 the session. One exception is the maxlogin option, this one is system
152 wide. But there is a race, concurrent logins at the same time will not
153 always be detected as such but only counted as one.
154 In the limits configuration file, the '#' character introduces a
156 comment - after which the rest of the line is ignored.
157 The pam_limits module does report configuration problems found in its
159 configuration file and errors via syslog(3).
160
162 These are some example lines which might be specified in
163 /etc/security/limits.conf.
164 * soft core 0
166 * hard nofile 512
167 @student hard nproc 20
168 @faculty soft nproc 20
169 @faculty hard nproc 50
170 ftp hard nproc 0
171 @student - maxlogins 4
172 :123 hard cpu 5000
173 @500: soft cpu 10000
174 600:700 hard locks 10
175
178 pam_limits(8), pam.d(5), pam(8), getrlimit(2)getrlimit(3p)
179
181 pam_limits was initially written by Cristian Gafton <gafton@redhat.com>
182Linux-PAM Manual 04/11/2018 LIMITS.CONF(5)