How to limit a special user's process can not use too many memory?

[MA Qiang]

Thanks.

[A. Clay Stephenson]

1) Buy the PRM (Process Resource Management) product.

2) Not as powerful but will work. Add a ulimit -d nnnn command either to his .profile or create a wrapper script for the program that does a limit -d before exec'ing the program.

[Ninad_1]

Hi,

There are various limits
data segment, stack, memory - which you can see by ulimit -a

In the user's .profile insert the following line

ulimit -d data_size_kb
ulimit -s stack_size_kb
ulimit -m memory_size_kb

Put the necessary value in KB

Hope that helps,
Ninad

[MA Qiang]

User can modify the .profile by himself. How to force the limit without PRM?

[A. Clay Stephenson · Accepted solution]

That's why you buy PRM. All of your other options apply globally unless you modify this user's .profile. Even if you did not allow writes to .profile, this user could still outbushwhack you by replacing his .profile with another unless you removed write permission on his home directory -- which is generally not practical.

Again, you could create a wrapper that would invoke the "real" program after setting ulimit to some desired value and moving the "real" program somewhere else. If that wrpapper is a script then because the user must have read permission to execute it, he can easily see where the real program is. It would be better in this case to create a C wrapper and only set the execute bits so that it would not be vulnerable to a strings command.


Fundamentally, I think you are taking the wrong approach. You should discuss the problem with this user. If this is an application for which you have the source code then the limits could be a command-line option; if this is a memory leak problem then it should be fixed.

[Bill Hassell]

Actually, once you set a hard ulimit value for the user (perhaps in /etc/profile) then the user can only lower the value, not raise it. To be able lower or raise the value, it would have to be ulimit -S plus the new limit.

As Clay mentioned, this is a social engineering problem more than a technical problem. If the user insists on running a program that occupies far too much RAM (and requests to stop are ignored) then simply ask this person's manager to buy a very large amount of RAM just for this one person. That usually solves the problem.