linuxexpert-practice-labs/labs/lfcs/4-4-application-constraints

LFCS 4.4: Application and service constraints

Open-file limits for a service, what a running program uses, cgroup caps, login limits, and a privileged port for a non-root service.

Before you start

The lab installs nginx (running, on port 80) and lsof, and creates user alice (password Lab-Pass-1). It adds heartbeat.service, a small looping service like the one you wrote in 4.2, and webapp.service, which should serve /srv/webapp on port 81 as system user webapp but fails to start. Write answers to the files in /root/lab-answers/.

Tasks

1. Give nginx a limit of 65536 open files that survives package updates and reboots.
2. List every file, port and library the running nginx is using, and save the list in /root/lab-answers/2 (command output is fine).
3. Cap heartbeat.service at 200 MiB of memory and 20% of one CPU.
4. Give user alice a hard limit of 200 processes.
5. Make webapp.service run as the non-root user webapp but listen on port 81, a privileged port (nginx already has port 80), also after a reboot.

Hints

• systemctl edit nginx, LimitNOFILE=, grep 'open files' /proc/$(pgrep -o nginx)/limits.
• lsof -p, ss -tlnp, ldd, ls -l /proc/PID/fd.
• systemctl set-property, MemoryMax=, CPUQuota=, systemctl show -p MemoryMax -p CPUQuotaPerSecUSec.
• /etc/security/limits.d/; ulimit -Hu in a new login as alice (su - alice).
• journalctl -u webapp, AmbientCapabilities=CAP_NET_BIND_SERVICE, ss -tlnp 'sport = :81'.