linux-kernel - Re: [PATCH v5 7/8] Documentation: Add documentation for the Brute LSM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20210312174751.GB3103@ubuntu>
Date:   Fri, 12 Mar 2021 18:47:51 +0100
From:   John Wood <john.wood@....com>
To:     Andi Kleen <ak@...ux.intel.com>
Cc:     John Wood <john.wood@....com>, Kees Cook <keescook@...omium.org>,
        Jann Horn <jannh@...gle.com>,
        Randy Dunlap <rdunlap@...radead.org>,
        Jonathan Corbet <corbet@....net>,
        James Morris <jmorris@...ei.org>,
        Shuah Khan <shuah@...nel.org>,
        "Serge E. Hallyn" <serge@...lyn.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        linux-doc@...r.kernel.org, linux-kernel@...r.kernel.org,
        linux-security-module@...r.kernel.org,
        linux-kselftest@...r.kernel.org,
        kernel-hardening@...ts.openwall.com
Subject: Re: [PATCH v5 7/8] Documentation: Add documentation for the Brute LSM

On Thu, Mar 11, 2021 at 12:08:11PM -0800, Andi Kleen wrote:
> > When a brute force attack is detected through the fork or execve system call,
> > all the tasks involved in the attack will be killed with the exception of the
> > init task (task with pid equal to zero). Now, and only if the init task is
> > involved in the attack, block the fork system call from the init process during
> > a user defined time (using a sysctl attribute). This way the brute force attack
> > is mitigated and the system does not panic.
>
> That means nobody can log in and fix the system during that time.
>
> Would be better to have that policy in init. Perhaps add some way
> that someone doing wait*() can know the exit was due this mitigation
> (and not something way) Then they could disable respawning of that daemon.

Great. So, if we use wait*() to inform userspace that the exit of a process was
due to a brute force attack then, the supervisors (not only init) can adopt the
necessary policy in each case. This also allow us to deal with the respawned
daemons.

As a summary of this useful discussion:

- When a brute force attack is detected through the fork or execve system call
  all the offending tasks involved in the attack will be killed. Due to the
  mitigation normally not reach init, do nothing special in this case -> the
  system will panic when we kill init.

- Use wait*() to inform userspace that every process killed by the mitigation
  has exited due to a brute force attack mitigation. So, each supervisor can
  adopt their own policy regarding respawned daemons.

I will work in that direction for the next version.

Thanks a lot for your time, proposals, guidance and solutions.
John Wood