# proc_sys_fs

## NAME



           /proc/sys/fs/ - kernel variables related to filesystems
    


## DESCRIPTION



           _/proc/sys/fs/_
                  This directory contains the files and subdirectories for
                  kernel variables related to filesystems.
    
           _/proc/sys/fs/aio-max-nr_
           _/proc/sys/fs/aio-nr_ (both since Linux 2.6.4)
                  _aio-nr_ is the running total of the number of events
                  specified by io_setup(2) calls for all currently active AIO
                  contexts.  If _aio-nr_ reaches _aio-max-nr_ , then io_setup(2)
                  will fail with the error **EAGAIN**.  Raising _aio-max-nr_ does
                  not result in the preallocation or resizing of any kernel
                  data structures.
    
           _/proc/sys/fs/binfmt_misc_
                  Documentation for files in this directory can be found in
                  the Linux kernel source in the file
                  _Documentation/admin-guide/binfmt-misc.rst_ (or in
                  _Documentation/binfmt_misc.txt_ on older kernels).
    
           _/proc/sys/fs/dentry-state_ (since Linux 2.2)
                  This file contains information about the status of the
                  directory cache (dcache).  The file contains six numbers,
                  _nr_dentry_ , _nr_unused_ , _age_limit_ (age in seconds),
                  _want_pages_ (pages requested by system) and two dummy
                  values.
    
                  •  _nr_dentry_ is the number of allocated dentries (dcache
                     entries).  This field is unused in Linux 2.2.
    
                  •  _nr_unused_ is the number of unused dentries.
    
                  •  _age_limit_ is the age in seconds after which dcache
                     entries can be reclaimed when memory is short.
    
                  •  _want_pages_ is nonzero when the kernel has called
                     shrink_dcache_pages() and the dcache isn't pruned yet.
    
           _/proc/sys/fs/dir-notify-enable_
                  This file can be used to disable or enable the _dnotify_
                  interface described in fcntl(2) on a system-wide basis.  A
                  value of 0 in this file disables the interface, and a value
                  of 1 enables it.
    
           _/proc/sys/fs/dquot-max_
                  This file shows the maximum number of cached disk quota
                  entries.  On some (2.4) systems, it is not present.  If the
                  number of free cached disk quota entries is very low and
                  you have some awesome number of simultaneous system users,
                  you might want to raise the limit.
    
           _/proc/sys/fs/dquot-nr_
                  This file shows the number of allocated disk quota entries
                  and the number of free disk quota entries.
    
           _/proc/sys/fs/epoll/_ (since Linux 2.6.28)
                  This directory contains the file _max_user_watches_ , which
                  can be used to limit the amount of kernel memory consumed
                  by the _epoll_ interface.  For further details, see epoll(7).
    
           _/proc/sys/fs/file-max_
                  This file defines a system-wide limit on the number of open
                  files for all processes.  System calls that fail when
                  encountering this limit fail with the error **ENFILE**.  (See
                  also setrlimit(2), which can be used by a process to set
                  the per-process limit, **RLIMIT_NOFILE** , on the number of
                  files it may open.)  If you get lots of error messages in
                  the kernel log about running out of file handles (open file
                  descriptions) (look for "VFS: file-max limit <number>
                  reached"), try increasing this value:
    
                      echo 100000 > /proc/sys/fs/file-max
    
                  Privileged processes (**CAP_SYS_ADMIN**) can override the
                  _file-max_ limit.
    
           _/proc/sys/fs/file-nr_
                  This (read-only) file contains three numbers: the number of
                  allocated file handles (i.e., the number of open file
                  descriptions; see open(2)); the number of free file
                  handles; and the maximum number of file handles (i.e., the
                  same value as _/proc/sys/fs/file-max_).  If the number of
                  allocated file handles is close to the maximum, you should
                  consider increasing the maximum.  Before Linux 2.6, the
                  kernel allocated file handles dynamically, but it didn't
                  free them again.  Instead the free file handles were kept
                  in a list for reallocation; the "free file handles" value
                  indicates the size of that list.  A large number of free
                  file handles indicates that there was a past peak in the
                  usage of open file handles.  Since Linux 2.6, the kernel
                  does deallocate freed file handles, and the "free file
                  handles" value is always zero.
    
           _/proc/sys/fs/inode-max_ (only present until Linux 2.2)
                  This file contains the maximum number of in-memory inodes.
                  This value should be 3–4 times larger than the value in
                  _file-max_ , since _stdin_ , _stdout_ and network sockets also need
                  an inode to handle them.  When you regularly run out of
                  inodes, you need to increase this value.
    
                  Starting with Linux 2.4, there is no longer a static limit
                  on the number of inodes, and this file is removed.
    
           _/proc/sys/fs/inode-nr_
                  This file contains the first two values from _inode-state_.
    
           _/proc/sys/fs/inode-state_
                  This file contains seven numbers: _nr_inodes_ ,
                  _nr_free_inodes_ , _preshrink_ , and four dummy values (always
                  zero).
    
                  _nr_inodes_ is the number of inodes the system has allocated.
                  _nr_free_inodes_ represents the number of free inodes.
    
                  _preshrink_ is nonzero when the _nr_inodes_ > _inode-max_ and the
                  system needs to prune the inode list instead of allocating
                  more; since Linux 2.4, this field is a dummy value (always
                  zero).
    
           _/proc/sys/fs/inotify/_ (since Linux 2.6.13)
                  This directory contains files _max_queued_events_ ,
                  _max_user_instances_ , and _max_user_watches_ , that can be used
                  to limit the amount of kernel memory consumed by the
                  _inotify_ interface.  For further details, see inotify(7).
    
           _/proc/sys/fs/lease-break-time_
                  This file specifies the grace period that the kernel grants
                  to a process holding a file lease (fcntl(2)) after it has
                  sent a signal to that process notifying it that another
                  process is waiting to open the file.  If the lease holder
                  does not remove or downgrade the lease within this grace
                  period, the kernel forcibly breaks the lease.
    
           _/proc/sys/fs/leases-enable_
                  This file can be used to enable or disable file leases
                  (fcntl(2)) on a system-wide basis.  If this file contains
                  the value 0, leases are disabled.  A nonzero value enables
                  leases.
    
           _/proc/sys/fs/mount-max_ (since Linux 4.9)
                  The value in this file specifies the maximum number of
                  mounts that may exist in a mount namespace.  The default
                  value in this file is 100,000.
    
           _/proc/sys/fs/mqueue/_ (since Linux 2.6.6)
                  This directory contains files _msg_max_ , _msgsize_max_ , and
                  _queues_max_ , controlling the resources used by POSIX message
                  queues.  See mq_overview(7) for details.
    
           _/proc/sys/fs/nr_open_ (since Linux 2.6.25)
                  This file imposes a ceiling on the value to which the
                  **RLIMIT_NOFILE** resource limit can be raised (see
                  getrlimit(2)).  This ceiling is enforced for both
                  unprivileged and privileged process.  The default value in
                  this file is 1048576.  (Before Linux 2.6.25, the ceiling
                  for **RLIMIT_NOFILE** was hard-coded to the same value.)
    
           _/proc/sys/fs/overflowgid_
           _/proc/sys/fs/overflowuid_
                  These files allow you to change the value of the fixed UID
                  and GID.  The default is 65534.  Some filesystems support
                  only 16-bit UIDs and GIDs, although in Linux UIDs and GIDs
                  are 32 bits.  When one of these filesystems is mounted with
                  writes enabled, any UID or GID that would exceed 65535 is
                  translated to the overflow value before being written to
                  disk.
    
           _/proc/sys/fs/pipe-max-size_ (since Linux 2.6.35)
                  See pipe(7).
    
           _/proc/sys/fs/pipe-user-pages-hard_ (since Linux 4.5)
                  See pipe(7).
    
           _/proc/sys/fs/pipe-user-pages-soft_ (since Linux 4.5)
                  See pipe(7).
    
           _/proc/sys/fs/protected_fifos_ (since Linux 4.19)
                  The value in this file is/can be set to one of the
                  following:
    
                  0   Writing to FIFOs is unrestricted.
    
                  1   Don't allow **O_CREAT open**(2) on FIFOs that the caller
                      doesn't own in world-writable sticky directories,
                      unless the FIFO is owned by the owner of the directory.
    
                  2   As for the value 1, but the restriction also applies to
                      group-writable sticky directories.
    
                  The intent of the above protections is to avoid
                  unintentional writes to an attacker-controlled FIFO when a
                  program expected to create a regular file.
    
           _/proc/sys/fs/protected_hardlinks_ (since Linux 3.6)
                  When the value in this file is 0, no restrictions are
                  placed on the creation of hard links (i.e., this is the
                  historical behavior before Linux 3.6).  When the value in
                  this file is 1, a hard link can be created to a target file
                  only if one of the following conditions is true:
    
                  •  The calling process has the **CAP_FOWNER** capability in its
                     user namespace and the file UID has a mapping in the
                     namespace.
    
                  •  The filesystem UID of the process creating the link
                     matches the owner (UID) of the target file (as described
                     in credentials(7), a process's filesystem UID is
                     normally the same as its effective UID).
    
                  •  All of the following conditions are true:
    
                      •  the target is a regular file;
    
                      •  the target file does not have its set-user-ID mode
                         bit enabled;
    
                      •  the target file does not have both its set-group-ID
                         and group-executable mode bits enabled; and
    
                      •  the caller has permission to read and write the
                         target file (either via the file's permissions mask
                         or because it has suitable capabilities).
    
                  The default value in this file is 0.  Setting the value to
                  1 prevents a longstanding class of security issues caused
                  by hard-link-based time-of-check, time-of-use races, most
                  commonly seen in world-writable directories such as _/tmp_.
                  The common method of exploiting this flaw is to cross
                  privilege boundaries when following a given hard link
                  (i.e., a root process follows a hard link created by
                  another user).  Additionally, on systems without separated
                  partitions, this stops unauthorized users from "pinning"
                  vulnerable set-user-ID and set-group-ID files against being
                  upgraded by the administrator, or linking to special files.
    
           _/proc/sys/fs/protected_regular_ (since Linux 4.19)
                  The value in this file is/can be set to one of the
                  following:
    
                  0   Writing to regular files is unrestricted.
    
                  1   Don't allow **O_CREAT open**(2) on regular files that the
                      caller doesn't own in world-writable sticky
                      directories, unless the regular file is owned by the
                      owner of the directory.
    
                  2   As for the value 1, but the restriction also applies to
                      group-writable sticky directories.
    
                  The intent of the above protections is similar to
                  _protected_fifos_ , but allows an application to avoid writes
                  to an attacker-controlled regular file, where the
                  application expected to create one.
    
           _/proc/sys/fs/protected_symlinks_ (since Linux 3.6)
                  When the value in this file is 0, no restrictions are
                  placed on following symbolic links (i.e., this is the
                  historical behavior before Linux 3.6).  When the value in
                  this file is 1, symbolic links are followed only in the
                  following circumstances:
    
                  •  the filesystem UID of the process following the link
                     matches the owner (UID) of the symbolic link (as
                     described in credentials(7), a process's filesystem UID
                     is normally the same as its effective UID);
    
                  •  the link is not in a sticky world-writable directory; or
    
                  •  the symbolic link and its parent directory have the same
                     owner (UID)
    
                  A system call that fails to follow a symbolic link because
                  of the above restrictions returns the error **EACCES** in
                  _errno_.
    
                  The default value in this file is 0.  Setting the value to
                  1 avoids a longstanding class of security issues based on
                  time-of-check, time-of-use races when accessing symbolic
                  links.
    
           _/proc/sys/fs/suid_dumpable_ (since Linux 2.6.13)
                  The value in this file is assigned to a process's
                  "dumpable" flag in the circumstances described in prctl(2).
                  In effect, the value in this file determines whether core
                  dump files are produced for set-user-ID or otherwise
                  protected/tainted binaries.  The "dumpable" setting also
                  affects the ownership of files in a process's _/proc/_ pid
                  directory, as described above.
    
                  Three different integer values can be specified:
    
                  _0 (default)_
                         This provides the traditional (pre-Linux 2.6.13)
                         behavior.  A core dump will not be produced for a
                         process which has changed credentials (by calling
                         seteuid(2), setgid(2), or similar, or by executing a
                         set-user-ID or set-group-ID program) or whose binary
                         does not have read permission enabled.
    
                  _1 ("debug")_
                         All processes dump core when possible.  (Reasons why
                         a process might nevertheless not dump core are
                         described in core(5).)  The core dump is owned by
                         the filesystem user ID of the dumping process and no
                         security is applied.  This is intended for system
                         debugging situations only: this mode is insecure
                         because it allows unprivileged users to examine the
                         memory contents of privileged processes.
    
                  _2 ("suidsafe")_
                         Any binary which normally would not be dumped (see
                         "0" above) is dumped readable by root only.  This
                         allows the user to remove the core dump file but not
                         to read it.  For security reasons core dumps in this
                         mode will not overwrite one another or other files.
                         This mode is appropriate when administrators are
                         attempting to debug problems in a normal
                         environment.
    
                         Additionally, since Linux 3.6,
                         _/proc/sys/kernel/core_pattern_ must either be an
                         absolute pathname or a pipe command, as detailed in
                         core(5).  Warnings will be written to the kernel log
                         if _core_pattern_ does not follow these rules, and no
                         core dump will be produced.
    
                  For details of the effect of a process's "dumpable" setting
                  on ptrace access mode checking, see ptrace(2).
    
           _/proc/sys/fs/super-max_
                  This file controls the maximum number of superblocks, and
                  thus the maximum number of mounted filesystems the kernel
                  can have.  You need increase only _super-max_ if you need to
                  mount more filesystems than the current value in _super-max_
                  allows you to.
    
           _/proc/sys/fs/super-nr_
                  This file contains the number of filesystems currently
                  mounted.
    


* * *