linux-kernel - [RFC][PATCH 0/3] A forkbomb killer and mm tracking system

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 23 Mar 2011 13:23:23 +0900
From:	KAMEZAWA Hiroyuki <kamezawa.hiroyu@...fujitsu.com>
To:	linux-kernel@...r.kernel.org
Cc:	"linux-mm@...ck.org" <linux-mm@...ck.org>,
	"kosaki.motohiro@...fujitsu.com" <kosaki.motohiro@...fujitsu.com>,
	"rientjes@...gle.com" <rientjes@...gle.com>,
	"akpm@...ux-foundation.org" <akpm@...ux-foundation.org>,
	Oleg Nesterov <oleg@...hat.com>,
	"minchan.kim@...il.com" <minchan.kim@...il.com>, avagin@...nvz.org,
	kirill@...temov.name
Subject: [RFC][PATCH 0/3] A forkbomb killer and mm tracking system

Hi,

This is a new one. All design was changed.

While testing Andrey's case, I confirmed I need to reboot the system by
power off when I ran a fork-bomb. The speed of fork() is much faster
than some smart killing as pkill(1) and oom-killer cannot reach the speed.
I wonder it's better to have a fork-bomb killer.

In previous version, the kernel finds guilty processes(forkbomb) by chasing
task's process tree chain. But, it cannot kill a famous forkbomb

# forkbomb(){ forkbomb|forkbomb & } ; forkbomb
(see wikipedia.)

To kill this bomb, we need to track dead processes. This version uses
a mm_struct tracking system. All mm_structs are recorded with its
parent-chidlren, start_time information. (A periodic work will erase
that information.) And forkbomb killer kills tasks by using the map
of relationship among mm_structs.

I tested with
# forkbomb(){ forkbomb|forkbomb & } ; forkbomb
# make -j Kernel
# Andrey's case

and all bombs are removed by ForkBomb Killer. 
Maybe more tests and development will be required.

(If there is swap, it's hard to kill bombs automatically....I used Sysrq.)

Any comments are welcome.

Thanks,
-Kame

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/