📄 users-limiting.html

📁 这是很好的学习嵌入式LINUX的文章
💻 HTML
字号:
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta name="generator" content="HTML Tidy, see www.w3.org" /><title>Limiting Users</title><meta name="GENERATOR" content="Modular DocBook HTML Stylesheet Version 1.7" /><link rel="HOME" title="FreeBSD Handbook" href="index.html" /><link rel="UP" title="Users and Basic Account Management" href="users.html" /><link rel="PREVIOUS" title="Modifying Accounts" href="users-modifying.html" /><link rel="NEXT" title="Personalizing Users" href="users-personalizing.html" /><link rel="STYLESHEET" type="text/css" href="docbook.css" /></head><body class="SECT1" bgcolor="#FFFFFF" text="#000000" link="#0000FF" vlink="#840084"alink="#0000FF"><div class="NAVHEADER"><table summary="Header navigation table" width="100%" border="0" cellpadding="0"cellspacing="0"><tr><th colspan="3" align="center">FreeBSD Handbook</th></tr><tr><td width="10%" align="left" valign="bottom"><a href="users-modifying.html"accesskey="P">Prev</a></td><td width="80%" align="center" valign="bottom">Chapter 13 Users and Basic AccountManagement</td><td width="10%" align="right" valign="bottom"><a href="users-personalizing.html"accesskey="N">Next</a></td></tr></table><hr align="LEFT" width="100%" /></div><div class="SECT1"><h1 class="SECT1"><a id="USERS-LIMITING" name="USERS-LIMITING">13.7 LimitingUsers</a></h1><p>If you have users, the ability to limit their system use may have come to mind.FreeBSD provides several ways an administrator can limit the amount of system resourcesan individual may use. These limits are divided into two sections: disk quotas, and otherresource limits.</p><p>Disk quotas limit disk usage to users, and they provide a way to quickly check thatusage without calculating it every time. Quotas are discussed in <ahref="quotas.html">Section 16.14</a>.</p><p>The other resource limits include ways to limit the amount of CPU, memory, and otherresources a user may consume. These are defined using login classes and are discussedhere.</p><p>Login classes are defined in <tt class="FILENAME">/etc/login.conf</tt>. The precisesemantics are beyond the scope of this section, but are described in detail in the <ahref="http://www.FreeBSD.org/cgi/man.cgi?query=login.conf&sektion=5"><spanclass="CITEREFENTRY"><span class="REFENTRYTITLE">login.conf</span>(5)</span></a> manualpage. It is sufficient to say that each user is assigned to a login class (<varclass="LITERAL">default</var> by default), and that each login class has a set of logincapabilities associated with it. A login capability is a <var class="LITERAL"><varclass="REPLACEABLE">name</var>=<var class="REPLACEABLE">value</var></var> pair, where<var class="REPLACEABLE">name</var> is a well-known identifier and <varclass="REPLACEABLE">value</var> is an arbitrary string processed accordingly depending onthe name. Setting up login classes and capabilities is rather straight-forward and isalso described in <ahref="http://www.FreeBSD.org/cgi/man.cgi?query=login.conf&sektion=5"><spanclass="CITEREFENTRY"><span class="REFENTRYTITLE">login.conf</span>(5)</span></a>.</p><div class="NOTE"><blockquote class="NOTE"><p><b>Note:</b> The system does not read the configuration in <ttclass="FILENAME">/etc/login.conf</tt> directly, but reads the database file <ttclass="FILENAME">/etc/login.conf.db</tt>. To generate <ttclass="FILENAME">/etc/login.conf.db</tt> from <tt class="FILENAME">/etc/login.conf</tt>,execute the following command:</p><pre class="SCREEN"><samp class="PROMPT">#</samp> <kbd class="USERINPUT">cap_mkdb /etc/login.conf</kbd></pre></blockquote></div><p>Resource limits are different from plain vanilla login capabilities in two ways.First, for every limit, there is a soft (current) and hard limit. A soft limit may beadjusted by the user or application, but may be no higher than the hard limit. The lattermay be lowered by the user, but never raised. Second, most resource limits apply perprocess to a specific user, not the user as a whole. Note, however, that thesedifferences are mandated by the specific handling of the limits, not by theimplementation of the login capability framework (i.e., they are not <spanclass="emphasis"><i class="EMPHASIS">really</i></span> a special case of logincapabilities).</p><p>And so, without further ado, below are the most commonly used resource limits (therest, along with all the other login capabilities, may be found in <ahref="http://www.FreeBSD.org/cgi/man.cgi?query=login.conf&sektion=5"><spanclass="CITEREFENTRY"><span class="REFENTRYTITLE">login.conf</span>(5)</span></a>).</p><div class="VARIABLELIST"><dl><dt><var class="LITERAL">coredumpsize</var></dt><dd><p>The limit on the size of a core file generated by a program is, for obvious reasons,subordinate to other limits on disk usage (e.g., <var class="LITERAL">filesize</var>, ordisk quotas). Nevertheless, it is often used as a less-severe method of controlling diskspace consumption: since users do not generate core files themselves, and often do notdelete them, setting this may save them from running out of disk space should a largeprogram (e.g., <b class="APPLICATION">emacs</b>) crash.</p></dd><dt><var class="LITERAL">cputime</var></dt><dd><p>This is the maximum amount of CPU time a user's process may consume. Offendingprocesses will be killed by the kernel.</p><div class="NOTE"><blockquote class="NOTE"><p><b>Note:</b> This is a limit on CPU <span class="emphasis"><iclass="EMPHASIS">time</i></span> consumed, not percentage of the CPU as displayed in somefields by <a href="http://www.FreeBSD.org/cgi/man.cgi?query=top&sektion=1"><spanclass="CITEREFENTRY"><span class="REFENTRYTITLE">top</span>(1)</span></a> and <ahref="http://www.FreeBSD.org/cgi/man.cgi?query=ps&sektion=1"><spanclass="CITEREFENTRY"><span class="REFENTRYTITLE">ps</span>(1)</span></a>. A limit on thelatter is, at the time of this writing, not possible, and would be rather useless: acompiler--probably a legitimate task--can easily use almost 100% of a CPU for sometime.</p></blockquote></div><br /><br /></dd><dt><var class="LITERAL">filesize</var></dt><dd><p>This is the maximum size of a file the user may possess. Unlike <ahref="quotas.html">disk quotas</a>, this limit is enforced on individual files, not theset of all files a user owns.</p></dd><dt><var class="LITERAL">maxproc</var></dt><dd><p>This is the maximum number of processes a user may be running. This includesforeground and background processes alike. For obvious reasons, this may not be largerthan the system limit specified by the <var class="VARNAME">kern.maxproc</var> <ahref="http://www.FreeBSD.org/cgi/man.cgi?query=sysctl&sektion=8"><spanclass="CITEREFENTRY"><span class="REFENTRYTITLE">sysctl</span>(8)</span></a>. Also notethat setting this too small may hinder a user's productivity: it is often useful to belogged in multiple times or execute pipelines. Some tasks, such as compiling a largeprogram, also spawn multiple processes (e.g., <ahref="http://www.FreeBSD.org/cgi/man.cgi?query=make&sektion=1"><spanclass="CITEREFENTRY"><span class="REFENTRYTITLE">make</span>(1)</span></a>, <ahref="http://www.FreeBSD.org/cgi/man.cgi?query=cc&sektion=1"><spanclass="CITEREFENTRY"><span class="REFENTRYTITLE">cc</span>(1)</span></a>, and otherintermediate preprocessors).</p></dd><dt><var class="LITERAL">memorylocked</var></dt><dd><p>This is the maximum amount a memory a process may have requested to be locked intomain memory (e.g., see <ahref="http://www.FreeBSD.org/cgi/man.cgi?query=mlock&sektion=2"><spanclass="CITEREFENTRY"><span class="REFENTRYTITLE">mlock</span>(2)</span></a>). Somesystem-critical programs, such as <ahref="http://www.FreeBSD.org/cgi/man.cgi?query=amd&sektion=8"><spanclass="CITEREFENTRY"><span class="REFENTRYTITLE">amd</span>(8)</span></a>, lock into mainmemory such that in the event of being swapped out, they do not contribute to a system'strashing in time of trouble.</p></dd><dt><var class="LITERAL">memoryuse</var></dt><dd><p>This is the maximum amount of memory a process may consume at any given time. Itincludes both core memory and swap usage. This is not a catch-all limit for restrictingmemory consumption, but it is a good start.</p></dd><dt><var class="LITERAL">openfiles</var></dt><dd><p>This is the maximum amount of files a process may have open. In FreeBSD, files arealso used to represent sockets and IPC channels; thus, be careful not to set this toolow. The system-wide limit for this is defined by the <varclass="VARNAME">kern.maxfiles</var> <ahref="http://www.FreeBSD.org/cgi/man.cgi?query=sysctl&sektion=8"><spanclass="CITEREFENTRY"><span class="REFENTRYTITLE">sysctl</span>(8)</span></a>.</p></dd><dt><var class="LITERAL">sbsize</var></dt><dd><p>This is the limit on the amount of network memory, and thus mbufs, a user may consume.This originated as a response to an old DoS attack by creating a lot of sockets, but canbe generally used to limit network communications.</p></dd><dt><var class="LITERAL">stacksize</var></dt><dd><p>This is the maximum size a process' stack may grow to. This alone is not sufficient tolimit the amount of memory a program may use; consequently, it should be used inconjunction with other limits.</p></dd></dl></div><p>There are a few other things to remember when setting resource limits. Following aresome general tips, suggestions, and miscellaneous comments.</p><ul><li><p>Processes started at system startup by <tt class="FILENAME">/etc/rc</tt> are assignedto the <var class="LITERAL">daemon</var> login class.</p></li><li><p>Although the <tt class="FILENAME">/etc/login.conf</tt> that comes with the system is agood source of reasonable values for most limits, only you, the administrator, can knowwhat is appropriate for your system. Setting a limit too high may open your system up toabuse, while setting it too low may put a strain on productivity.</p></li><li><p>Users of the X Window System (X11) should probably be granted more resources thanother users. X11 by itself takes a lot of resources, but it also encourages users to runmore programs simultaneously.</p></li><li><p>Remember that many limits apply to individual processes, not the user as a whole. Forexample, setting <var class="VARNAME">openfiles</var> to 50 means that each process theuser runs may open up to 50 files. Thus, the gross amount of files a user may open is thevalue of <var class="LITERAL">openfiles</var> multiplied by the value of <varclass="LITERAL">maxproc</var>. This also applies to memory consumption.</p></li></ul><p>For further information on resource limits and login classes and capabilities ingeneral, please consult the relevant manual pages: <ahref="http://www.FreeBSD.org/cgi/man.cgi?query=cap_mkdb&sektion=1"><spanclass="CITEREFENTRY"><span class="REFENTRYTITLE">cap_mkdb</span>(1)</span></a>, <ahref="http://www.FreeBSD.org/cgi/man.cgi?query=getrlimit&sektion=2"><spanclass="CITEREFENTRY"><span class="REFENTRYTITLE">getrlimit</span>(2)</span></a>, <ahref="http://www.FreeBSD.org/cgi/man.cgi?query=login.conf&sektion=5"><spanclass="CITEREFENTRY"><span class="REFENTRYTITLE">login.conf</span>(5)</span></a>.</p></div><div class="NAVFOOTER"><hr align="LEFT" width="100%" /><table summary="Footer navigation table" width="100%" border="0" cellpadding="0"cellspacing="0"><tr><td width="33%" align="left" valign="top"><a href="users-modifying.html"accesskey="P">Prev</a></td><td width="34%" align="center" valign="top"><a href="index.html"accesskey="H">Home</a></td><td width="33%" align="right" valign="top"><a href="users-personalizing.html"accesskey="N">Next</a></td></tr><tr><td width="33%" align="left" valign="top">Modifying Accounts</td><td width="34%" align="center" valign="top"><a href="users.html"accesskey="U">Up</a></td><td width="33%" align="right" valign="top">Personalizing Users</td></tr></table></div><p align="center"><small>This, and other documents, can be downloaded from <ahref="ftp://ftp.FreeBSD.org/pub/FreeBSD/doc/">ftp://ftp.FreeBSD.org/pub/FreeBSD/doc/</a>.</small></p><p align="center"><small>For questions about FreeBSD, read the <ahref="http://www.FreeBSD.org/docs.html">documentation</a> before contacting &#60;<ahref="mailto:questions@FreeBSD.org">questions@FreeBSD.org</a>&#62;.<br />For questions about this documentation, e-mail &#60;<ahref="mailto:doc@FreeBSD.org">doc@FreeBSD.org</a>&#62;.</small></p></body></html>
⌨️ 快捷键说明

复制代码 Ctrl + C
搜索代码 Ctrl + F
全屏模式 F11
切换主题 Ctrl + Shift + D
显示快捷键 ?
增大字号 Ctrl + =
减小字号 Ctrl + -