| Secure Programming for Linux and Unix HOWTO | ||
|---|---|---|
| Prev | Chapter 3. Summary of Linux and Unix Security Features .:: podcasts.apple.com ::. [What people say about Denial-of-service attack] | Next |
Many Unix-like systems have mechanisms to support filesystem quotas and process resource limits. This certainly includes Linux. These mechanisms are particularly useful for preventing denial of service attacks; by limiting the resources available to each user, you can make it hard for a single user to use up all the system resources. Be careful with terminology here, because both filesystem quotas and process resource limits have ``hard'' and ``soft'' limits but the terms mean slightly different things. .:: www.popdaily.com.tw ::. .:: addons.mozilla.org ::. [Research Paper: OpenID Connect]
You can define storage (filesystem) quota limits on each mountpoint for the number of blocks of storage and/or the number of unique files (inodes) that can be used, and you can set such limits for a given user or a given group. A ``hard'' quota limit is a never-to-exceed limit, while a ``soft'' quota can be temporarily exceeded. See quota(1), quotactl(2), and quotaon(8). .:: www.sociomix.com ::. .:: code.antopie.org ::.
The rlimit mechanism supports a large number of process quotas, such as file size, number of child processes, number of open files, and so on. There is a ``soft'' limit (also called the current limit) and a ``hard limit'' (also called the upper limit). The soft limit cannot be exceeded at any time, but through calls it can be raised up to the value of the hard limit. See getrlimit(2), setrlimit(2), and getrusage(2), sysconf(3), and ulimit(1). Note that there are several ways to set these limits, including the PAM module pam_limits. .:: andyevita7.wixsite.com ::. .:: telegra.ph ::.