What do you know about ulimits and how to use them in Linux systems?

Ulimits (user limits) are restrictions on resource consumption by processes in the Linux operating system. They help prevent a single process from exhausting system resources and ensure stability.

The main resources that can be limited using ulimits include:

• CPU time (seconds): Maximum CPU time for a process.
• File size (blocks): Maximum size of a file that a user can create.
• Data segment size (kbytes): Maximum size of a process's data segment.
• Stack size (kbytes): Maximum size of a process's stack.
• Core file size (blocks): Maximum size of a core dump.
• Resident set size (kbytes): Maximum size of a process's resident memory (often not supported or only has a "soft" limit).
• Number of processes: Maximum number of processes a user can create.
• Open files: Maximum number of files a process can open.
• Locked memory ([kbytes]): Maximum amount of memory that can be locked in RAM.
• Max user processes: Maximum number of processes available to a specific user (ignores other user IDs in counting).
• Pending signals: Maximum number of signals that can wait in the queue for a specific process.
• Msgqueue size (bytes): Maximum size of the POSIX message queue.
• Real-time priority: Maximum real-time priority that can be set.
• Nice priority: Maximum "soft" priority value.
• Real-time locked memory (kbytes): Maximum size of memory locked for real-time tasks.

Ulimits come in two types:

• Soft limit: The current, actively applied limit. A user or process can increase the soft limit but not above the hard limit.
• Hard limit: The maximum possible limit set by the administrator. Only the superuser (root) can increase the hard limit.

Viewing current ulimits:

Use the ulimit command in the shell (e.g., bash).

# Show all soft limits
ulimit -a

# Show hard limit for open files
ulimit -Hn

Setting ulimits:

Ulimits can be set temporarily for the current session or process, or permanently.

Temporary setting:

Use the ulimit command in the shell. This only affects the current shell and child processes launched from it.

# Set soft limit for open files to 4096
ulimit -Sn 4096

# Set hard limit for the number of processes to 100
ulimit -Hu 100

Permanent setting:

Edit the /etc/security/limits.conf file or files in the /etc/security/limits.d/ directory. This method requires superuser rights and is applied when a user logs into the system (via PAM).

Format of /etc/security/limits.conf:

# <domain>  <type>  <item>  <value>
# Domain can be: user (@group), group (@group), wildcard (*)
# Type can be: soft, hard, - (both)
# Item - resource type (nofile, nproc, etc.)
# Value - limit value

*       soft    nofile  4096       # All users, soft limit on open files 4096
@mygroup hard    nproc   256        # Group mygroup, hard limit on processes 256
myuser  -       stack   8192       # User myuser, both limits on stack 8192 kB

After modifying /etc/security/limits.conf, re-login is required for changes to take effect.

Ulimits are often used for:

• Preventing "fork bombs" (processes creating many child processes).
• Memory restrictions consumed by processes to prevent "out of memory" situations.
• Limiting the number of open files, important for network applications and databases.
• Controlling CPU consumption by resource-intensive applications.

Using ulimits is an important part of system hardening and ensuring stability and predictability of application operation in a production environment.