linux-kernel - Re: Patch related with Fork Bombing Atack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 1 Jun 2007 19:59:49 +0530
From:	"Anand Jahagirdar" <anandjigar@...il.com>
To:	"Jiri Kosina" <jikos@...os.cz>
Cc:	"Jens Axboe" <jens.axboe@...cle.com>, security@...nel.org,
	linux-kernel@...r.kernel.org
Subject: Re: Patch related with Fork Bombing Atack

Hello All

                I totally agree with all of you, but my idea behind
this patch is that administrator/root user must be able to know that
there is fork bombing attack on his machine and he should be able take
action agianst that particular user and kill all his processes.

can anybody please tell me how can we achive this??

Regards
Anand

On 6/1/07, Jiri Kosina <jikos@...os.cz> wrote:
> On Fri, 1 Jun 2007, Anand Jahagirdar wrote:
>
> >     when they try to flood the syslog using fork bombing attack, their
> > messge will be printed only once in syslog and it will show how many
> > times it has repeated. due to this he will not able to flood the
> > syslog.and i am using only one single variable in my printk messge so it
> > is quite not possible to flood the syslog.
>
> Your argument is flawed - if the kernel provides more than one possibility
> to flood the syslogd, the is free to invoke the events interleaved. This
> trivially prevents syslogd from grouping identical reports together.
>
> --
> Jiri Kosina
>
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/