Skip to content
Browse

/config/imagemagick/policy-xml

ImageMagick policy.xml: resource limits and coder rules

The commands on this page have not been executed by our verification runner yet.updated 2026-10-20
tool
ImageMagick
file
policy.xml
key
<policy domain=… name=… pattern=… rights=… value=…/>
type
XML policy elements
default
distribution-specific; ImageMagick ships an open policy, many distributions a restricted one

policy.xml controls what ImageMagick may do: how much memory, disk and time it can use, the maximum image size it accepts, and which file formats (coders), paths and delegates are allowed. When a conversion fails with "cache resources exhausted", "width exceeds limit" or "not allowed by the security policy", this file is the place to look.

Where it is

bash
magick -list policy     # ImageMagick 7
convert -list policy    # ImageMagick 6

The output starts with the path of the active file and lists every rule in effect.

Policy domains

DomainControlsExample
resourcememory, map, disk, area, width, height, time, thread limits<policy domain="resource" name="memory" value="1GiB"/>
coderimage formats that may be read or written<policy domain="coder" rights="none" pattern="PDF"/>
delegateexternal programs ImageMagick may call<policy domain="delegate" rights="none" pattern="URL"/>
pathfile system paths that may be accessed<policy domain="path" rights="none" pattern="@*"/>
moduleloadable modules<policy domain="module" rights="none" pattern="{PS,PDF,XPS}"/>

Raise limits for large images

policy.xml
<policy domain="resource" name="width" value="32KP"/>
<policy domain="resource" name="height" value="32KP"/>
<policy domain="resource" name="area" value="256MP"/>
<policy domain="resource" name="memory" value="2GiB"/>
<policy domain="resource" name="disk" value="8GiB"/>

Sizes accept units such as KiB, MiB, GiB; pixel limits accept KP (kilopixels) and MP (megapixels).

Pitfalls

  • A command-line -limit memory 4GiB cannot exceed the value set in policy.xml; the policy is an upper bound.
  • rights="none" on pattern="@*" blocks reading file lists with @file.txt, which some scripts rely on.
  • Keep coder restrictions (PS, EPS, PDF, XPS, MSL) on servers that process untrusted uploads.

Sources

Related pages

errors · imagemagickImageMagick: not allowed by the security policy `PDF'ImageMagick refuses to read or write PDF, PS or EPS when policy.xml disables the Ghostscript coders. Allow the PDF coder in policy.xml for trusted files only.changes · imagemagickImageMagick 6 to 7: convert becomes magickImageMagick 7 replaces convert with magick, runs identify, mogrify and compare as magick subcommands, enables HDRI by default and changes the MagickCore C API.cheat sheets · ffmpegFFmpeg cheat sheet: convert, cut, scale, extract and inspectFFmpeg cheat sheet: inspect files with ffprobe, change containers, encode H.264, cut without re-encoding, scale, extract audio, make GIFs and thumbnails.