OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Aleksander Adamowski (olo_at_altkom.com.pl)
Date: Tue Jul 09 2002 - 04:35:58 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    Kurt Seifried wrote:

    >The available limits are:
    >
    > core -- Limits the core file size (KB); usually set to 0 for most users to
    >prevent core dumps.
    > data -- Maximum data size (KB).
    > fsize -- Maximum file size (KB).
    > memlock -- Maximum locked-in-memory address space (KB).
    > nofile -- Maximum number of open files.
    > rss -- Maximum resident set size (KB).
    > stack -- Maximum stack size (KB).
    > cpu -- Maximum CPU time (MIN).
    > nproc -- Maximum number of processes.
    > as -- Address space limit.
    > maxlogins -- Maximum number of logins for this user or group.
    > priority -- The priority to run user process with.
    >
    >
    from bash manual:
    "The value of limit can be a number in the unit specified for the
    resource, or the value unlimited"

    Having a fixed, absolute limit on: number, size, amount of resources
    isn't very flexible - it's not dependent on current usage by other users.

    Now imagine there are 100 users of a system, all of them shouldn't be
    trusted and belong more or less to the same hash bucket (so you can't
    differentiate using per-group limits).
    Now, suppose that some of them use the system frequently, some of them
    sporadically, some of them require as much resources as possible for
    their work, some don't need that much. You can't determine beforehand
    who will need what.

    If you can't specify those limits so that they are relative to amount of
    resources available at the time of limit check, you're in problem -
    either you leave limits too high and one user can bring the machine to
    its knees, or you set the absolute limits and you start getting calls
    from frustrated users whose software doesn't work because of those
    limits being enforced.

    Best regards,

    -- 
        Olo
            GG#: 274614
            ICQ UIN: 19780575 
            http://olo.office.altkom.com.pl