/config/imagemagick/policy-xml
ImageMagick policy.xml: resource limits and coder rules
The commands on this page have not been executed by our verification runner yet.updated 2026-10-20
- tool
- ImageMagick
- file
- policy.xml
- key
- <policy domain=… name=… pattern=… rights=… value=…/>
- type
- XML policy elements
- default
- distribution-specific; ImageMagick ships an open policy, many distributions a restricted one
policy.xml controls what ImageMagick may do: how much memory, disk and time it can use, the maximum image size it accepts, and which file formats (coders), paths and delegates are allowed. When a conversion fails with "cache resources exhausted", "width exceeds limit" or "not allowed by the security policy", this file is the place to look.
Where it is
magick -list policy # ImageMagick 7
convert -list policy # ImageMagick 6The output starts with the path of the active file and lists every rule in effect.
Policy domains
| Domain | Controls | Example |
|---|---|---|
| resource | memory, map, disk, area, width, height, time, thread limits | <policy domain="resource" name="memory" value="1GiB"/> |
| coder | image formats that may be read or written | <policy domain="coder" rights="none" pattern="PDF"/> |
| delegate | external programs ImageMagick may call | <policy domain="delegate" rights="none" pattern="URL"/> |
| path | file system paths that may be accessed | <policy domain="path" rights="none" pattern="@*"/> |
| module | loadable modules | <policy domain="module" rights="none" pattern="{PS,PDF,XPS}"/> |
Raise limits for large images
<policy domain="resource" name="width" value="32KP"/>
<policy domain="resource" name="height" value="32KP"/>
<policy domain="resource" name="area" value="256MP"/>
<policy domain="resource" name="memory" value="2GiB"/>
<policy domain="resource" name="disk" value="8GiB"/>Sizes accept units such as KiB, MiB, GiB; pixel limits accept KP (kilopixels) and MP (megapixels).
Pitfalls
- A command-line
-limit memory 4GiBcannot exceed the value set inpolicy.xml; the policy is an upper bound. rights="none"onpattern="@*"blocks reading file lists with@file.txt, which some scripts rely on.- Keep coder restrictions (PS, EPS, PDF, XPS, MSL) on servers that process untrusted uploads.
Sources
Related pages
errors · imagemagickImageMagick: not allowed by the security policy `PDF'ImageMagick refuses to read or write PDF, PS or EPS when policy.xml disables the Ghostscript coders. Allow the PDF coder in policy.xml for trusted files only.changes · imagemagickImageMagick 6 to 7: convert becomes magickImageMagick 7 replaces convert with magick, runs identify, mogrify and compare as magick subcommands, enables HDRI by default and changes the MagickCore C API.cheat sheets · ffmpegFFmpeg cheat sheet: convert, cut, scale, extract and inspectFFmpeg cheat sheet: inspect files with ffprobe, change containers, encode H.264, cut without re-encoding, scale, extract audio, make GIFs and thumbnails.