0

I've seen on the documentantion the following about the type field of /etc/security/limits.conf:

-
  for enforcing both soft and hard resource limits together.

  Note, if you specify a type of '-' but neglect to supply the
  item and value fields then the module will never enforce any
  limits on the specified user/group etc. .

In the manual page we have this example:

*               soft    core            0
*               hard    nofile          512
@student        hard    nproc           20
@faculty        soft    nproc           20
@faculty        hard    nproc           50
ftp             hard    nproc           0
@student        -       maxlogins       4

The configuration for the group @student has a - as type. In this context, what does it means?

  • 2
    it is my understanding that it is for creating a item that can be adjusted downward only. By being both hard and soft, and initialized at 4, the user can adjust down to 3/2/1, and raise it back up again, but never higher than 4. Its effectively the same as having two lines, one hard and one soft, with the same value. The soft limit can be adjusted by the user, and the hard limit cannot, so if the value is initialized at the same (max) value, the - saves you a line. Syntactic Sugar. – Frank Thomas Jan 27 '17 at 2:58
  • Oh! So when the documentation said that minus sign it "for enforcing both soft and hard resource limits together" it just meant: both types will have the same value. Great then. Thank you :) – juniorgarcia Jan 28 '17 at 0:03
1

The other parameters are process rlimits enforced by kernel – soft limit is the one in effect, but the user (or a program) can raise it up to the hard one. Hard limit cannot be raised (except by root), only lowered. So it's sometimes useful to set one separately, or both.

Maxlogins, however, is not a rlimit – the kernel doesn't track logins as such. The login limit is enforced by pam_limits itself, by counting (I think) session entries in utmp. So it doesn't have the soft/hard split.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.