Skip to content

Commit 9e5df76

Browse files
msaladnamsaladna
committed
PAM limits
1 parent c90fad0 commit 9e5df76

File tree

3 files changed

+88
-1
lines changed

3 files changed

+88
-1
lines changed

‎docs/.vuepress/config.js

+1
Original file line numberDiff line numberDiff line change
@@ -242,6 +242,7 @@ module.exports = {
242242
},
243243
"admin/FTP",
244244
"admin/Monitoring",
245+
"admin/Limits",
245246
"admin/Resource enforcement",
246247
"admin/Metrics",
247248
"admin/Kernel",

‎docs/admin/Limits.md

+86
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
## Process limits
2+
3+
Limits are a per-process resource enforcement mechanism. This system provides a rudimentary backstop against runaway processes. [cgroup](Resource%20enforcement.md) is intended for account-wide resource limits.
4+
5+
Process limits are applied using a PAM wrapper on PAM-aware applications, which include any login service (FTP, mail, SSH, crond).
6+
7+
## Format
8+
9+
Limits may be overridden in Bootstrapper or by including a lexicographically higher file than [`10-apnscp-system.conf`](https://gitlab.com/apisnetworks/apnscp/-/blob/master/resources/playbooks/roles/system/limits/templates/apnscp.conf.j2) in `FST/siteinfo/etc/security/limits.d` (see [Filesystem.md](Filesystem.md#filesystem-template). Files published within this location are inherited by all sites.
10+
11+
Settings take the following form:
12+
13+
```
14+
#DOMAIN TYPE RESOURCE VALUE
15+
# Disable coredumps for everyone
16+
* - core 0
17+
# Enable coredumps for users under "site12"
18+
@foobar soft core unlimited
19+
# Restrict number of files opened by PHP-FPM
20+
nobody soft nfiles 2048
21+
# Limit any account with a user "phil" from running more than 25 processes
22+
phil hard nproc 25
23+
```
24+
25+
::: tip Domain resolution
26+
User resolution is completed inside the virtual environment. In the above example "phil" applies to *any account* with a user named "phil". Often it is inappropriate to publish limits within the FST except as stopgap limits for runaway resource consumption for all users (`*`) or the unprivileged [PHP-FPM](./PHP-FPM.md) user, `apache`.
27+
:::
28+
29+
A **domain** may be of the form:
30+
31+
- username, resolved within the [vfs](Filesystem.md).
32+
- group name using `@group` syntax
33+
- wildcard `*` for default entry
34+
- wildcard `%`, can be also used with `%group` syntax, for `maxlogin` limit
35+
36+
## Resources
37+
38+
The following table summarizes available resource limits.
39+
40+
| Value | Units | Remarks |
41+
| ------------ | --------- | ----------------------------------------------- |
42+
| core | KB† | Limits core file size. `0` disables core files. |
43+
| data | KB† | Maximum data segment size. |
44+
| fsize | KB† | Maximum filesize. |
45+
| memlock | KB | Maximum locked-in-memory address space. |
46+
| nofile | [0,2^20]† | Maximum number of open file descriptors. |
47+
| rss | KB† | Ignored. |
48+
| stack | KB | Maximum stack size. |
49+
| cpu | minutes | Maximum CPU time. |
50+
| nproc | [0,2^63) | Max number of processes. |
51+
| as | KB† | Address space limit (vmem). |
52+
| maxlogins | — | Max number of logins for this user. |
53+
| maxsyslogins | — | Max number of global logins for system. |
54+
| priority | [0,2^63) | Real-time process priority. |
55+
| locks | [0,2^63)† | Max number of locks. |
56+
| sigpending | [0,2^63) | Max number of pending signals. |
57+
| msgqueue | B | Max memory used by POSIX message queues. |
58+
| nice | [-20, 19] | Max nice priority allowed to raise. |
59+
| rtprio | [0,2^63) | Max real-time priority. |
60+
61+
***†** values specified accept `unlimited` as a value.*
62+
63+
## Hard and soft
64+
65+
Type may either be "hard" or "soft". A hard limit is the maximal value allowed for a resource. Only root may change this. Soft values may be changed by a user up to the hard limit.
66+
67+
Consider the following in `site1/fst/etc/security/limits.d/nice-limit.conf`:
68+
69+
```
70+
* soft nice 0
71+
* hard nice -5
72+
```
73+
74+
```bash
75+
su site1
76+
whoami
77+
# Reports admin
78+
renice 0 $$
79+
# 30307 (process ID) old priority 19, new priority 0
80+
renice -1 $$
81+
# renice: failed to set priority for 30307 (process ID): permission denied
82+
```
83+
84+
::: tip Explanation
85+
A user is able to increase process priority from 19 down to 0 but may not specify a negative process priority, which preempts other processes on the system. A priority of 0 gives equal weighting to all system processes while a value greater than 0 would deprioritize.
86+
:::

‎docs/admin/Resource enforcement.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -395,7 +395,7 @@ cat /sys/fs/cgroup/memory/site1/memory.usage_in_bytes
395395

396396
This can be confirmed by examining `memory.stat` in the cgroup home. Likewise memory reported by a process may be higher than memory reported by cgroup, this is because cgroup only accounts for memory uniquely reserved by the application. A fork shares its parent's memory pages and copies-on-write at which point the newly claimed memory is charged to the cgroup.
397397

398-
## CloudLinux terminology
398+
## CloudLinux equivalences
399399

400400
Both ApisCP and CloudLinux utilize cgroups for resource enforcement. The table below summarizes the relationships between CloudLinux limit variables and ApisCP's equivalent settings.
401401

0 commit comments

Comments
 (0)