Feature request: module [pam_limits]

[Ralf Mardorf]

#<domain>      <type>  <item>         <value>
@foo           soft    nproc          20
@foo           hard    nproc          50

Every user who is _not_ in the group "foo", simply is _not_ in
this group, it makes completely no sense to introduce a negation of
being in a group, since the negation is already not being member of this
group.

[foo at linux ~]$ id foo
uid=1000(foo) gid=1000(foo) groups=1000(foo)

[foo at linux ~]$ id bar 
uid=1001(bar) gid=1001(bar) groups=1001(bar),1000(foo)

[foo at linux ~]$ id jane_doe
uid=1002(jane_doe) gid=1002(jane_doe) groups=1002(jane_doe)

What would you gain by introducing a negation of being in a group? You
only would lose clarity?

You could set up a new group, if nobody should be in the group
"foo", but the user "foo".

#<domain>      <type>  <item>         <value>
@npgroup       soft    nproc          20
@npgroup       hard    nproc          50

[foo at linux ~]$ id foo
uid=1000(foo) gid=1000(foo) groups=1000(foo),50(npgroup)

[foo at linux ~]$ id bar 
uid=1001(bar) gid=1001(bar) groups=1001(bar),50(npgroup)

[foo at linux ~]$ id jane_doe
uid=1002(jane_doe) gid=1002(jane_doe) groups=1002(jane_doe)