Skip to content

Commit cfbc5ba

Browse files
bschonecbschonec
authored
Add the management of limits.conf file. (#44)
1 parent 6f7f1d3 commit cfbc5ba

File tree

10 files changed

+264
-1
lines changed

10 files changed

+264
-1
lines changed

‎README.md‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ Manage user and group limits via Puppet
44

55
This module manages the limits of the PAM module pam_limits.
66

7-
It creates files in `/etc/security/limits.d` and does not manage the file `/etc/security/limits.conf`
7+
It creates files in `/etc/security/limits.d` and optionally manages the file `/etc/security/limits.conf`
88

99
## How to use
1010

@@ -23,7 +23,12 @@ It creates files in `/etc/security/limits.d` and does not manage the file `/etc/
2323

2424
* `purge_limits_d_dir` (Boolean, default: true) Whether or not to purge the limits.d directory
2525
* `manage_limits_d_dir` (Boolean, default: true) Whether or not to manage the limits.d directory
26+
* `manage_limits_file` (Boolean, default: false) Whether or not to manage the /etc/security/limits.conf file.
27+
* `limits_file` (String, default: /etc/security/limits.conf) The name of the limits file to be managed.
2628
* `limits_dir`: (String) The location of the limits.d directory
29+
* `limits_file_owner`: (String, default: root) The owner of the ${limits_file} file.
30+
* `limits_file_group`: (String, default: root) The group of the ${limits_file} file.
31+
* `limits_file_mode`: (String, defaul: '0644') The file mode of the ${limits_file} file.
2732
* `entries`: (Hash) A hash of limits entries, keys should be the name and the value as a hash made up of;
2833
* `ensure`: (String, default present) Values can be absent or present
2934
* `user`: (String) The user that the limit applies to

‎data/Debian.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
---
2+
3+
limits::limits_template: 'limits.conf.ubuntu'

‎data/RedHat/9.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
---
2+
3+
limits::limits_template: 'limits.conf.rhel9'

‎data/common.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,3 +7,14 @@ limits::entries: {}
77
limits::limits_dir: /etc/security/limits.d
88
limits::manage_limits_d_dir: true
99
limits::purge_limits_d_dir: true
10+
11+
limits::limits_file: /etc/security/limits.conf
12+
limits::manage_limits_file: false
13+
limits::limits_file_owner: 'root'
14+
limits::limits_file_group: 'root'
15+
limits::limits_file_mode: '0644'
16+
17+
# We'll use a generic limits.conf template file (which came from RHEL7)
18+
# until a specific tempalte for each OS and/or major OS version
19+
# is supplied.
20+
limits::limits_template: 'generic'

‎hiera.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,5 +4,18 @@ defaults:
44
datadir: data
55
data_hash: yaml_data
66
hierarchy:
7+
8+
- name: "osfamily/major release"
9+
paths:
10+
# Used to distinguish between Debian and Ubuntu
11+
- "os/%{facts.os.name}/%{facts.os.release.major}.yaml"
12+
- "os/%{facts.os.family}/%{facts.os.release.major}.yaml"
13+
14+
- name: "osfamily"
15+
paths:
16+
- "os/%{facts.os.name}.yaml"
17+
- "os/%{facts.os.family}.yaml"
18+
719
- name: "common"
820
path: "common.yaml"
21+

‎manifests/init.pp‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,34 @@
11
# == Class: limits
2+
# @summary Manage user and group limits via Puppet
3+
#
4+
# This module manages the limits of the PAM module pam_limits.
5+
#
6+
# @example
7+
# include limits
8+
#
9+
# @param limits_file_owner
10+
# The owner of the limits.conf file.
11+
#
12+
# @param limits_file_group
13+
# The group of the limits.conf file.
14+
#
15+
# @param limits_file_mode
16+
# The mode of the limits.conf file.
17+
#
18+
# @param limits_template
19+
# The name of the template to use for ${limits_file
220
#
321
class limits (
422
Hash $entries,
523
String $limits_dir,
624
Boolean $manage_limits_d_dir,
725
Boolean $purge_limits_d_dir,
26+
String $limits_file = $limits::limits_file,
27+
Boolean $manage_limits_file = false,
28+
String[1] $limits_file_owner = $limits::limits_file_owner,
29+
String[1] $limits_file_group = $limits::limits_file_group,
30+
String[1] $limits_file_mode = $limits::limits_file_mode,
31+
Optional[String] $limits_template = $limits::limits_template,
832
) {
933
if $manage_limits_d_dir {
1034
file { $limits_dir:
@@ -17,6 +41,16 @@
1741
}
1842
}
1943

44+
if $manage_limits_file {
45+
file { $limits_file:
46+
ensure => 'file',
47+
owner => $limits_file_owner,
48+
group => $limits_file_group,
49+
mode => $limits_file_mode,
50+
content => template("limits/${limits_template}.erb"),
51+
}
52+
}
53+
2054
$entries.each | String $e_name, Hash $e_params | {
2155
limits::limits { $e_name:
2256
* => $e_params,

‎spec/classes/init_spec.rb‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,10 @@
2626
'purge' => true
2727
)
2828
end
29+
30+
it do
31+
is_expected.not_to contain_file('/etc/security/limits.conf')
32+
end
2933
end
3034

3135
describe 'with purge_limits_d_dir set to false' do
@@ -56,6 +60,23 @@
5660

5761
it { is_expected.not_to contain_file('/etc/security/limits.d') }
5862
end
63+
64+
describe 'with manage_limits_file set to true' do
65+
let :params do
66+
{
67+
manage_limits_file: true
68+
}
69+
end
70+
71+
it do
72+
is_expected.to contain_file('/etc/security/limits.conf').with(
73+
'ensure' => 'file',
74+
'owner' => 'root',
75+
'group' => 'root',
76+
'mode' => '0644'
77+
)
78+
end
79+
end
5980
end
6081
end
6182
end

‎templates/generic.erb‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# This file is managed by Puppet. Do not edit!
2+
#
3+
# /etc/security/limits.conf
4+
#
5+
#Each line describes a limit for a user in the form:
6+
#
7+
#<domain> <type> <item> <value>
8+
#
9+
#Where:
10+
#<domain> can be:
11+
# - a user name
12+
# - a group name, with @group syntax
13+
# - the wildcard *, for default entry
14+
# - the wildcard %, can be also used with %group syntax,
15+
# for maxlogin limit
16+
#
17+
#<type> can have the two values:
18+
# - "soft" for enforcing the soft limits
19+
# - "hard" for enforcing hard limits
20+
#
21+
#<item> can be one of the following:
22+
# - core - limits the core file size (KB)
23+
# - data - max data size (KB)
24+
# - fsize - maximum filesize (KB)
25+
# - memlock - max locked-in-memory address space (KB)
26+
# - nofile - max number of open file descriptors
27+
# - rss - max resident set size (KB)
28+
# - stack - max stack size (KB)
29+
# - cpu - max CPU time (MIN)
30+
# - nproc - max number of processes
31+
# - as - address space limit (KB)
32+
# - maxlogins - max number of logins for this user
33+
# - maxsyslogins - max number of logins on the system
34+
# - priority - the priority to run user process with
35+
# - locks - max number of file locks the user can hold
36+
# - sigpending - max number of pending signals
37+
# - msgqueue - max memory used by POSIX message queues (bytes)
38+
# - nice - max nice priority allowed to raise to values: [-20, 19]
39+
# - rtprio - max realtime priority
40+
#
41+
#<domain> <type> <item> <value>
42+
#
43+
44+
#* soft core 0
45+
#* hard rss 10000
46+
#@student hard nproc 20
47+
#@faculty soft nproc 20
48+
#@faculty hard nproc 50
49+
#ftp hard nproc 0
50+
#@student - maxlogins 4
51+
52+
# End of file

‎templates/limits.conf.debian.erb‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
# This file is managed by Puppet. Do not edit!
2+
#
3+
# /etc/security/limits.conf
4+
#
5+
#Each line describes a limit for a user in the form:
6+
#
7+
#<domain> <type> <item> <value>
8+
#
9+
#Where:
10+
#<domain> can be:
11+
# - a user name
12+
# - a group name, with @group syntax
13+
# - the wildcard *, for default entry
14+
# - the wildcard %, can be also used with %group syntax,
15+
# for maxlogin limit
16+
# - NOTE: group and wildcard limits are not applied to root.
17+
# To apply a limit to the root user, <domain> must be
18+
# the literal username root.
19+
#
20+
#<type> can have the two values:
21+
# - "soft" for enforcing the soft limits
22+
# - "hard" for enforcing hard limits
23+
#
24+
#<item> can be one of the following:
25+
# - core - limits the core file size (KB)
26+
# - data - max data size (KB)
27+
# - fsize - maximum filesize (KB)
28+
# - memlock - max locked-in-memory address space (KB)
29+
# - nofile - max number of open file descriptors
30+
# - rss - max resident set size (KB)
31+
# - stack - max stack size (KB)
32+
# - cpu - max CPU time (MIN)
33+
# - nproc - max number of processes
34+
# - as - address space limit (KB)
35+
# - maxlogins - max number of logins for this user
36+
# - maxsyslogins - max number of logins on the system
37+
# - priority - the priority to run user process with
38+
# - locks - max number of file locks the user can hold
39+
# - sigpending - max number of pending signals
40+
# - msgqueue - max memory used by POSIX message queues (bytes)
41+
# - nice - max nice priority allowed to raise to values: [-20, 19]
42+
# - rtprio - max realtime priority
43+
# - chroot - change root to directory (Debian-specific)
44+
#
45+
#<domain> <type> <item> <value>
46+
#
47+
48+
#* soft core 0
49+
#root hard core 100000
50+
#* hard rss 10000
51+
#@student hard nproc 20
52+
#@faculty soft nproc 20
53+
#@faculty hard nproc 50
54+
#ftp hard nproc 0
55+
#ftp - chroot /ftp
56+
#@student - maxlogins 4
57+
58+
# End of file

‎templates/limits.conf.rhel9.erb‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
# This file is managed by Puppet. Do not edit!
2+
#
3+
# /etc/security/limits.conf
4+
#
5+
#This file sets the resource limits for the users logged in via PAM.
6+
#It does not affect resource limits of the system services.
7+
#
8+
#Also note that configuration files in /etc/security/limits.d directory,
9+
#which are read in alphabetical order, override the settings in this
10+
#file in case the domain is the same or more specific.
11+
#That means, for example, that setting a limit for wildcard domain here
12+
#can be overridden with a wildcard setting in a config file in the
13+
#subdirectory, but a user specific setting here can be overridden only
14+
#with a user specific setting in the subdirectory.
15+
#
16+
#Each line describes a limit for a user in the form:
17+
#
18+
#<domain> <type> <item> <value>
19+
#
20+
#Where:
21+
#<domain> can be:
22+
# - a user name
23+
# - a group name, with @group syntax
24+
# - the wildcard *, for default entry
25+
# - the wildcard %, can be also used with %group syntax,
26+
# for maxlogin limit
27+
#
28+
#<type> can have the two values:
29+
# - "soft" for enforcing the soft limits
30+
# - "hard" for enforcing hard limits
31+
#
32+
#<item> can be one of the following:
33+
# - core - limits the core file size (KB)
34+
# - data - max data size (KB)
35+
# - fsize - maximum filesize (KB)
36+
# - memlock - max locked-in-memory address space (KB)
37+
# - nofile - max number of open file descriptors
38+
# - rss - max resident set size (KB)
39+
# - stack - max stack size (KB)
40+
# - cpu - max CPU time (MIN)
41+
# - nproc - max number of processes
42+
# - as - address space limit (KB)
43+
# - maxlogins - max number of logins for this user
44+
# - maxsyslogins - max number of logins on the system
45+
# - priority - the priority to run user process with
46+
# - locks - max number of file locks the user can hold
47+
# - sigpending - max number of pending signals
48+
# - msgqueue - max memory used by POSIX message queues (bytes)
49+
# - nice - max nice priority allowed to raise to values: [-20, 19]
50+
# - rtprio - max realtime priority
51+
#
52+
#<domain> <type> <item> <value>
53+
#
54+
55+
#* soft core 0
56+
#* hard rss 10000
57+
#@student hard nproc 20
58+
#@faculty soft nproc 20
59+
#@faculty hard nproc 50
60+
#ftp hard nproc 0
61+
#@student - maxlogins 4
62+
63+
# End of file

0 commit comments

Comments
 (0)