# /etc/security/limits.d/00-intergenos.conf — pam_limits.so per-user caps
# InterGenOS T0-4-B PAM-side closure (operator-greenlit RHEL 9 + CIS
# baseline 2026-05-20). Activated via pam_limits.so in system-session.

# Suppress core dumps system-wide.
# Security: prevents secret leakage via core files (DISA STIG RHEL-09-211045).
*    hard    core    0

# Per-user maximum concurrent logins.
# DoS mitigation; CIS 5.4.4 baseline. Raised 10 -> 50 (GBC001.2):
# 50 is still a hard ceiling no honest interactive user reaches, but
# gives recovery headroom so a crash-loop's orphaned VT/SSH sessions
# can't self-lock the box out of SSH (we hit exactly that at 10 during
# the GBC001.1 libEGL crash-loop). The root cause of that churn is fixed
# in libglvnd; this keeps the DoS cap while preventing lock-yourself-out.
*    hard    maxlogins    50

# Per-user process count.
# DoS mitigation; CIS 5.4.5 baseline. Root unlimited per RHEL convention.
*    soft    nproc    65535
*    hard    nproc    65535
root soft    nproc    unlimited
root hard    nproc    unlimited

# Per-user file descriptor cap.
*    soft    nofile    65535
*    hard    nofile    65535
