1LIMITS.CONF(5) Linux-PAM Manual LIMITS.CONF(5)
2
6 limits.conf - configuration file for the pam_limits module
7
9 The pam_limits.so module applies ulimit limits, nice priority and
10 number of simultaneous login sessions limit to user login sessions.
11 This description of the configuration file syntax applies to the
12 /etc/security/limits.conf file and *.conf files in the
13 /etc/security/limits.d directory.
14 The syntax of the lines is as follows:
16 <domain> <type> <item> <value>
18 The fields listed above should be filled as follows:
20 <domain>
22 • a username
24 • a groupname, with @group syntax. This should not be confused
26 with netgroups.
27 • the wildcard *, for default entry.
29 • the wildcard %, for maxlogins limit only, can also be used with
31 %group syntax. If the % wildcard is used alone it is identical
32 to using * with maxsyslogins limit. With a group specified
33 after % it limits the total number of logins of all users that
34 are member of the group.
35 • an uid range specified as <min_uid>:<max_uid>. If min_uid is
37 omitted, the match is exact for the max_uid. If max_uid is
38 omitted, all uids greater than or equal min_uid match.
39 • a gid range specified as @<min_gid>:<max_gid>. If min_gid is
41 omitted, the match is exact for the max_gid. If max_gid is
42 omitted, all gids greater than or equal min_gid match. For the
43 exact match all groups including the user's supplementary
44 groups are examined. For the range matches only the user's
45 primary group is examined.
46 • a gid specified as %:<gid> applicable to maxlogins limit only.
48 It limits the total number of logins of all users that are
49 member of the group with the specified gid.
50 <type>
52 hard
54 for enforcing hard resource limits. These limits are set by the
55 superuser and enforced by the Kernel. The user cannot raise his
56 requirement of system resources above such values.
57 soft
59 for enforcing soft resource limits. These limits are ones that
60 the user can move up or down within the permitted range by any
61 pre-existing hard limits. The values specified with this token
62 can be thought of as default values, for normal system usage.
63 -
65 for enforcing both soft and hard resource limits together.
66 Note, if you specify a type of '-' but neglect to supply the
68 item and value fields then the module will never enforce any
69 limits on the specified user/group etc. .
70 <item>
72 core
74 limits the core file size (KB)
75 data
77 maximum data size (KB)
78 fsize
80 maximum filesize (KB)
81 memlock
83 maximum locked-in-memory address space (KB)
84 nofile
86 maximum number of open file descriptors
87 rss
89 maximum resident set size (KB) (Ignored in Linux 2.4.30 and
90 higher)
91 stack
93 maximum stack size (KB)
94 cpu
96 maximum CPU time (minutes)
97 nproc
99 maximum number of processes
100 as
102 address space limit (KB)
103 maxlogins
105 maximum number of logins for this user (this limit does not
106 apply to user with uid=0)
107 maxsyslogins
109 maximum number of all logins on system; user is not allowed to
110 log-in if total number of all user logins is greater than
111 specified number (this limit does not apply to user with uid=0)
112 nonewprivs
114 value of 0 or 1; if set to 1 disables acquiring new privileges
115 by invoking prctl(PR_SET_NO_NEW_PRIVS)
116 priority
118 the priority to run user process with (negative values boost
119 process priority)
120 locks
122 maximum locked files (Linux 2.4 and higher)
123 sigpending
125 maximum number of pending signals (Linux 2.6 and higher)
126 msgqueue
128 maximum memory used by POSIX message queues (bytes) (Linux 2.6
129 and higher)
130 nice
132 maximum nice priority allowed to raise to (Linux 2.6.12 and
133 higher) values: [-20,19]
134 rtprio
136 maximum realtime priority allowed for non-privileged processes
137 (Linux 2.6.12 and higher)
138 All items support the values -1, unlimited or infinity indicating no
140 limit, except for priority, nice, and nonewprivs. If nofile is to be
141 set to one of these values, it will be set to the contents of
142 /proc/sys/fs/nr_open instead (see setrlimit(3)).
143 If a hard limit or soft limit of a resource is set to a valid value,
145 but outside of the supported range of the local system, the system may
146 reject the new limit or unexpected behavior may occur. If the control
147 value required is used, the module will reject the login if a limit
148 could not be set.
149 In general, individual limits have priority over group limits, so if
151 you impose no limits for admin group, but one of the members in this
152 group have a limits line, the user will have its limits set according
153 to this line.
154 Also, please note that all limit settings are set per login. They are
156 not global, nor are they permanent; existing only for the duration of
157 the session. One exception is the maxlogin option, this one is system
158 wide. But there is a race, concurrent logins at the same time will not
159 always be detect as such but only counted as one.
160 In the limits configuration file, the '#' character introduces a
162 comment - after which the rest of the line is ignored.
163 The pam_limits module does report configuration problems found in its
165 configuration file and errors via syslog(3).
166
168 These are some example lines which might be specified in
169 /etc/security/limits.conf.
170 * soft core 0
172 * hard nofile 512
173 @student hard nproc 20
174 @faculty soft nproc 20
175 @faculty hard nproc 50
176 ftp hard nproc 0
177 @student - maxlogins 4
178 @student - nonewprivs 1
179 :123 hard cpu 5000
180 @500: soft cpu 10000
181 600:700 hard locks 10
182
185 pam_limits(8), pam.d(5), pam(8), getrlimit(2), getrlimit(3p)
186
188 pam_limits was initially written by Cristian Gafton <gafton@redhat.com>
189Linux-PAM Manual 09/03/2021 LIMITS.CONF(5)