From: Andi Kleen <ak@linux.intel.com>
To: John Wood <john.wood@gmx.com>
Cc: Kees Cook <keescook@chromium.org>, Jann Horn <jannh@google.com>,
Randy Dunlap <rdunlap@infradead.org>,
Jonathan Corbet <corbet@lwn.net>,
James Morris <jmorris@namei.org>, Shuah Khan <shuah@kernel.org>,
"Serge E. Hallyn" <serge@hallyn.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-security-module@vger.kernel.org,
linux-kselftest@vger.kernel.org,
kernel-hardening@lists.openwall.com
Subject: Re: [PATCH v5 7/8] Documentation: Add documentation for the Brute LSM
Date: Sun, 7 Mar 2021 07:19:20 -0800 [thread overview]
Message-ID: <20210307151920.GR472138@tassilo.jf.intel.com> (raw)
In-Reply-To: <20210302183032.GA3049@ubuntu>
Sorry for the late answer. I somehow missed your email earlier.
> As a mitigation method, all the offending tasks involved in the attack are
> killed. Or in other words, all the tasks that share the same statistics
> (statistics showing a fast crash rate) are killed.
So systemd will just restart the network daemon and then the attack works
again?
Or if it's a interactive login you log in again.
I think it might be useful even with these limitations, but it would
be good to spell out the limitations of the method more clearly.
I suspect to be useful it'll likely need some user space configuration
changes too.
-Andi
next prev parent reply other threads:[~2021-03-07 15:20 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-02-27 15:30 [PATCH v5 0/8] Fork brute force attack mitigation John Wood
2021-02-27 15:30 ` [PATCH v5 1/8] security: Add LSM hook at the point where a task gets a fatal signal John Wood
2021-02-27 15:30 ` [PATCH v5 2/8] security/brute: Define a LSM and manage statistical data John Wood
2021-03-02 5:49 ` [security/brute] cfe92ab6a3: WARNING:inconsistent_lock_state kernel test robot
2021-03-02 5:49 ` kernel test robot
2021-03-02 18:39 ` John Wood
2021-03-02 18:39 ` John Wood
2021-02-27 15:30 ` [PATCH v5 3/8] securtiy/brute: Detect a brute force attack John Wood
2021-02-27 15:30 ` [PATCH v5 4/8] security/brute: Fine tuning the attack detection John Wood
2021-02-27 15:30 ` [PATCH v5 5/8] security/brute: Mitigate a brute force attack John Wood
2021-03-11 20:32 ` peter enderborg
2021-03-12 16:19 ` John Wood
2021-02-27 15:30 ` [PATCH v5 6/8] selftests/brute: Add tests for the Brute LSM John Wood
2021-02-27 15:30 ` [PATCH v5 7/8] Documentation: Add documentation " John Wood
2021-02-28 18:56 ` Andi Kleen
2021-02-28 18:56 ` Andi Kleen
2021-03-02 18:31 ` John Wood
2021-03-07 15:19 ` Andi Kleen [this message]
2021-03-07 16:45 ` John Wood
2021-03-07 17:25 ` Andi Kleen
2021-03-07 18:05 ` John Wood
2021-03-07 22:49 ` Andi Kleen
2021-03-09 18:40 ` John Wood
2021-03-11 18:22 ` John Wood
2021-03-11 20:08 ` Andi Kleen
2021-03-12 17:47 ` John Wood
2021-03-11 20:05 ` Andi Kleen
2021-03-12 17:54 ` John Wood
2021-02-27 15:30 ` [PATCH v5 8/8] MAINTAINERS: Add a new entry " John Wood
2021-02-27 18:44 ` [PATCH v5 0/8] Fork brute force attack mitigation John Wood
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210307151920.GR472138@tassilo.jf.intel.com \
--to=ak@linux.intel.com \
--cc=corbet@lwn.net \
--cc=gregkh@linuxfoundation.org \
--cc=jannh@google.com \
--cc=jmorris@namei.org \
--cc=john.wood@gmx.com \
--cc=keescook@chromium.org \
--cc=kernel-hardening@lists.openwall.com \
--cc=linux-doc@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=rdunlap@infradead.org \
--cc=serge@hallyn.com \
--cc=shuah@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.