linux-kernel - Re: Patch related with Fork Bombing Atack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 4 Jun 2007 16:58:41 +0200 (CEST)
From:	Jiri Kosina <jikos@...os.cz>
To:	Anand Jahagirdar <anandjigar@...il.com>
cc:	Daniel Hazelton <dhazelton@...er.net>, Nix <nix@...eri.org.uk>,
	Jens Axboe <jens.axboe@...cle.com>, security@...nel.org,
	linux-kernel@...r.kernel.org, Kedar Sovani <kedar@...amzgroup.com>
Subject: Re: Patch related with Fork Bombing Atack

On Mon, 4 Jun 2007, Anand Jahagirdar wrote:

>            I am forwarding one improved patch related with Fork Bombing 
> Attack. This patch prints a message (only once) which alerts 
> administrator/root user about fork bombing attack. I created this patch 
> to implement my idea of informing administrator about fork bombing 
> attack on his machine only once.
>    This patch overcomes all drawbacks of my previous patch related with 
> fork bombing attack and helps administrator. added comments will 
> definitely help developers.

> +	/*
> +	 * following code prints a message which alerts administrator/root 		 * user about fork bombing Attack
> +	 */
> +	if ((atomic_read(&p->user->processes) >= (p->signal->rlim	[RLIMIT_NPROC].rlim_cur - 1)) && (atomic_read(&p->user->processes) < p->signal->rlim[RLIMIT_NPROC].rlim_cur)) {

Did this get malformed somehow? Looks like some successive lines got 
pasted together, or something.

> +        	if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) && p->user != &root_user) {
> +        		printk(KERN_CRIT"User with uid %d is crossing its Process limit\n",p->user->uid);
> +        	}
> +	}

Why not printk_ratelimit() here? Otherwise we have looped back to the 
possibility of user flooding the system logs, which has been already 
discussed in this thread, right? 

Also the { and } braces seem redundant.

Thanks,

-- 
Jiri Kosina
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/