CME-114

Process Resource Limits (ulimit/prlimit)

Harden OS/Kernel Unquantified evidence Preventive

Description

Configures per-process resource limits via ulimit/prlimit to prevent algorithmic complexity attacks, infinite loops, and resource exhaustion from consuming unbounded system resources. Key limits include RLIMIT_CPU (maximum CPU time), RLIMIT_AS (maximum address space), RLIMIT_NPROC (maximum processes), and RLIMIT_NOFILE (maximum open files). Complements container-level cgroup limits (CME-704) by providing process-granularity controls that apply even outside containers.

CVSS Vector Impacts

Metric	Transition	Rationale
Availability (A)	H → L	Resource limits contain the blast radius of denial-of-service conditions to the targeted process rather than the system; an infinite loop consumes its CPU quota then receives SIGKILL, preventing system-wide resource exhaustion.

CWE Relationships

CWE-835 CWE-400 CWE-770 CWE-834 CWE-772 CWE-401

Verification

Check that CPU time limits are set for processes

$ ulimit -t
# Expected: A finite value (not unlimited)

Platform: linux

Remediation

linux systemd drop-in with LimitCPU, LimitAS, LimitNOFILE, LimitNPROC


mkdir -p /etc/systemd/system/<service>.service.d
printf '[Service]\nLimitCPU=300\nLimitAS=2147483648\nLimitNOFILE=65536\nLimitNPROC=4096\n' > /etc/systemd/system/<service>.service.d/resource-limits.conf
systemctl daemon-reload
systemctl restart <service>

linux PAM resource limits via /etc/security/limits.d drop-in


printf '<user>  hard  nproc   4096\n<user>  hard  nofile  65536\n<user>  hard  cpu     300\n' > /etc/security/limits.d/99-cme-114.conf