[cgiwrap-users] Proper Use of --with-rlimit-* Configuration Options

[Tim G. <tj...@so...>]

Hi,

I use cgiwrap to secure CGI scripts running in user's home directories on a shared web server.  I've had occasions where people have written buggy CGI scripts that use up tons of RAM (in some cases 8GB or more) and will run indefinitely (hours and hours) and I'd like to use the --with-rlimit-* options to fix that.  However, I'm not all that familiar with using the rlimit options, or using rlimit in general.

I was wondering if anyone could recommend good settings for these:

--with-rlimit-cpu
--with-rlimit-vmem
--with-rlimit-as
--with-rlimit-fsize
--with-rlimit-data
--with-rlimit-stack
--with-rlimit-core
--with-rlimit-rss
--with-rlimit-nproc
--with-rlimit-nofile
--with-rlimit-memlock

I think I want --with-rlimit-cpu=30 but I really am not 100% clear on the difference between all the different memory limits.  What are some sane numbers to use here for "average" user CGI scripts?

Tim Gustafson
Baskin School of Engineering
UC Santa Cruz
tj...@so...
831-459-5354