Shell New Added 17 October 2026

bash: ulimit: open files: cannot modify limit: Operation not permitted

An unprivileged shell can lower its soft limit or raise it up to the hard limit, but never past the hard limit. Running ulimit -n 65535 asks for more than the hard limit your session inherited. Editing limits.conf does nothing for services, which take their limits from systemd, and only applies to new logins via PAM, so the old shell keeps the old ceiling.

Quick fix

Read the commands before running them. Anything that restarts a service, deletes data or changes permissions should be tried on a non-production system first.

Quick fix

# Soft and hard limits for this shell
ulimit -Sn; ulimit -Hn

# Raise up to the hard limit, which needs no privilege
ulimit -n "$(ulimit -Hn)"

# For logins: raise both limits in limits.d, then log in again
echo '* soft nofile 65535' | sudo tee /etc/security/limits.d/90-nofile.conf
echo '* hard nofile 65535' | sudo tee -a /etc/security/limits.d/90-nofile.conf

# For a systemd service, limits.conf is ignored: use the unit
sudo systemctl edit myapp    # add: [Service] LimitNOFILE=65535
sudo systemctl restart myapp
grep "open files" /proc/$(pidof myapp)/limits

How to diagnose Shell errors

Shell errors are usually about PATH, permissions, or quoting and expansion. The quoting class is the most damaging because it fails silently: an unquoted variable containing a space becomes two arguments, and an empty one disappears entirely. Running shellcheck over any script longer than a few lines catches most of these before they run.

If the quick fix above does not resolve it, work through these steps. They apply to this whole class of error, not just to this one message, which is usually what saves the time.

Trace execution with bash -x script.sh to see each command after expansion. This makes quoting bugs immediately visible.
Start every script with set -euo pipefail so failures stop the script instead of cascading.
Quote every variable expansion: "$var", "${arr[@]}". This single habit prevents the majority of shell bugs.
Use command -v foo to check whether something is on PATH, and echo "$PATH" to see what the shell is actually searching.
In Makefiles, recipe lines must begin with a real tab character. "missing separator" always means spaces were used instead.

Tools worth reaching for

shellcheck
bash -x
set -euo pipefail
command -v
cat -A (to reveal tabs)

Authoritative references

Primary documentation for this error, worth reading before applying any fix in production.

man7.org freedesktop.org

Related Shell errors

See all 19 Shell errors →

Browse other categories

Something missing or wrong?

This entry is maintained by hand. If the fix is out of date, incomplete, or you have a better one, email a correction and it will be reviewed.