All of lore.kernel.org
 help / color / mirror / Atom feed
From: John Wood <john.wood@gmx.com>
To: Andi Kleen <ak@linux.intel.com>
Cc: John Wood <john.wood@gmx.com>, Kees Cook <keescook@chromium.org>,
	Jann Horn <jannh@google.com>,
	Randy Dunlap <rdunlap@infradead.org>,
	Jonathan Corbet <corbet@lwn.net>,
	James Morris <jmorris@namei.org>, Shuah Khan <shuah@kernel.org>,
	"Serge E. Hallyn" <serge@hallyn.com>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org,
	linux-security-module@vger.kernel.org,
	linux-kselftest@vger.kernel.org,
	kernel-hardening@lists.openwall.com
Subject: Re: [PATCH v5 7/8] Documentation: Add documentation for the Brute LSM
Date: Thu, 11 Mar 2021 19:22:52 +0100	[thread overview]
Message-ID: <20210311182252.GA3349@ubuntu> (raw)
In-Reply-To: <20210309184054.GA3058@ubuntu>

Hi,

On Tue, Mar 09, 2021 at 07:40:54PM +0100, John Wood wrote:
> On Sun, Mar 07, 2021 at 02:49:27PM -0800, Andi Kleen wrote:
>
> > So I think it needs more work on the user space side for most usages.
>
> Anyway, in the case that the supervisor is init then the system will panic. So,
> I think that we can add a prctl to avoid kill the parent task (the task that
> exec) and only block new fork system calls from this task. When this boolean is
> set, any parent task that is involved in the attack will not be killed. In this
> case, any following forks will be blocked. This way the system will not crash.

Another proposal that I think suits better:

When a brute force attack is detected through the fork or execve system call,
all the tasks involved in the attack will be killed with the exception of the
init task (task with pid equal to zero). Now, and only if the init task is
involved in the attack, block the fork system call from the init process during
a user defined time (using a sysctl attribute). This way the brute force attack
is mitigated and the system does not panic.

I think that this is a better solution than the other one since this is a per
system solution. And I believe that with a default value for the blocking time
(sysctl attribute) could be useful in a generic way (for most usages).

The proposal using prctl will need more actions from userspace and it is not a
generic one due to it is a per process solution.

> What do you think?

Thanks,
John Wood

  reply	other threads:[~2021-03-11 18:24 UTC|newest]

Thread overview: 30+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-02-27 15:30 [PATCH v5 0/8] Fork brute force attack mitigation John Wood
2021-02-27 15:30 ` [PATCH v5 1/8] security: Add LSM hook at the point where a task gets a fatal signal John Wood
2021-02-27 15:30 ` [PATCH v5 2/8] security/brute: Define a LSM and manage statistical data John Wood
2021-03-02  5:49   ` [security/brute] cfe92ab6a3: WARNING:inconsistent_lock_state kernel test robot
2021-03-02  5:49     ` kernel test robot
2021-03-02 18:39     ` John Wood
2021-03-02 18:39       ` John Wood
2021-02-27 15:30 ` [PATCH v5 3/8] securtiy/brute: Detect a brute force attack John Wood
2021-02-27 15:30 ` [PATCH v5 4/8] security/brute: Fine tuning the attack detection John Wood
2021-02-27 15:30 ` [PATCH v5 5/8] security/brute: Mitigate a brute force attack John Wood
2021-03-11 20:32   ` peter enderborg
2021-03-12 16:19     ` John Wood
2021-02-27 15:30 ` [PATCH v5 6/8] selftests/brute: Add tests for the Brute LSM John Wood
2021-02-27 15:30 ` [PATCH v5 7/8] Documentation: Add documentation " John Wood
2021-02-28 18:56   ` Andi Kleen
2021-02-28 18:56     ` Andi Kleen
2021-03-02 18:31     ` John Wood
2021-03-07 15:19       ` Andi Kleen
2021-03-07 16:45         ` John Wood
2021-03-07 17:25           ` Andi Kleen
2021-03-07 18:05             ` John Wood
2021-03-07 22:49               ` Andi Kleen
2021-03-09 18:40                 ` John Wood
2021-03-11 18:22                   ` John Wood [this message]
2021-03-11 20:08                     ` Andi Kleen
2021-03-12 17:47                       ` John Wood
2021-03-11 20:05                   ` Andi Kleen
2021-03-12 17:54                     ` John Wood
2021-02-27 15:30 ` [PATCH v5 8/8] MAINTAINERS: Add a new entry " John Wood
2021-02-27 18:44 ` [PATCH v5 0/8] Fork brute force attack mitigation John Wood

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210311182252.GA3349@ubuntu \
    --to=john.wood@gmx.com \
    --cc=ak@linux.intel.com \
    --cc=corbet@lwn.net \
    --cc=gregkh@linuxfoundation.org \
    --cc=jannh@google.com \
    --cc=jmorris@namei.org \
    --cc=keescook@chromium.org \
    --cc=kernel-hardening@lists.openwall.com \
    --cc=linux-doc@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-kselftest@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=rdunlap@infradead.org \
    --cc=serge@hallyn.com \
    --cc=shuah@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.