Cronjob to watch for runaway processes and kill them

While it can be an abuse for memory, it isn't for CPU: when a CPU is idle, a running process (by "running", I mean that the process isn't waiting for I/O or something else) will take 100% CPU time by default. And there's no reason to enforce a limit.

Now, you can set up priorities thanks to nice. If you want them to apply to all processes for a given user, you just need to make sure that his login shell is run with nice: the child processes will inherit the nice value. This depends on how the users log in. See Prioritise ssh logins (nice) for instance.

Alternatively, you can set up virtual machines. Indeed setting a per-process limit doesn't make much sense since the user can start many processes, abusing the system. With a virtual machine, all the limits will be global to the virtual machine.

Another solution is to set /etc/security/limits.conf limits; see the limits.conf(5) man page. For instance, you can set the maximum CPU time per login and/or the maximum number of processes per login. You can also set maxlogins to 1 for each user.

Running some rudimentary tests I’m seeing this too on 10.13.4.

I wrote a small C program called looper which did some basic maths in an infinite loop:

#include <stdio.h>

int main(){
    unsigned long long prev = 0;
    unsigned long long current = 1;
    unsigned long long total = 0;

    while(1){
        total = current + prev;
        prev = current;
        current = total;
        printf("%llu\n", total);
    }
}

I ran multiple copies of this on my FreeBSD box and examined them using htop(1). Using renice(8) I could see the Nice value being incremented, the Priority value being incremented, and the CPU percentage decreasing - expected behavior.

I ran the same program on macOS 10.13.4 and repeated the process. While I could see the Nice value incrementing, the Priority value and CPU percentage remained consistent.

I wonder if it is a bug, I've not had cause to look this closely at Nice values in macOS before - the behavior has been close enough to what I expected that I've not been inclined to investigate.

If you have a developer account it would be worth reporting this to Apple.