From: John Wood <firstname.lastname@example.org> To: Andi Kleen <email@example.com> Cc: John Wood <firstname.lastname@example.org>, Kees Cook <email@example.com>, Jann Horn <firstname.lastname@example.org>, Randy Dunlap <email@example.com>, Jonathan Corbet <firstname.lastname@example.org>, James Morris <email@example.com>, Shuah Khan <firstname.lastname@example.org>, "Serge E. Hallyn" <email@example.com>, Greg Kroah-Hartman <firstname.lastname@example.org>, email@example.com, firstname.lastname@example.org, email@example.com, firstname.lastname@example.org, email@example.com Subject: Re: [PATCH v5 7/8] Documentation: Add documentation for the Brute LSM Date: Sun, 7 Mar 2021 19:05:41 +0100 [thread overview] Message-ID: <20210307180541.GA17108@ubuntu> (raw) In-Reply-To: <20210307172540.GS472138@tassilo.jf.intel.com> On Sun, Mar 07, 2021 at 09:25:40AM -0800, Andi Kleen wrote: > > processes created from it will be killed. If the systemd restart the network > > daemon and it will crash again, then the systemd will be killed. I think this > > way the attack is fully mitigated. > > Wouldn't that panic the system? Killing init is usually a panic. The mitigation acts only over the process that crashes (network daemon) and the process that exec() it (systemd). This mitigation don't go up in the processes tree until reach the init process. Note: I am a kernel newbie and I don't know if the systemd is init. Sorry if it is a stupid question. AFAIK systemd is not the init process (the first process that is executed) but I am not sure. > > > > Or if it's a interactive login you log in again. > > > > First the login will be killed (if it fails with a fatal signal) and if it is > > restarted, the process that exec() it again will be killed. In this case I think > > that the threat is also completely mitigated. > > Okay so sshd will be killed. And if it gets restarted eventually init, > so panic again. In this scenario the process that exec() the login will be killed (sshd process). But I think that sshd is not the init process. So no panic. > That's a fairly drastic consequence because even without panic > it means nobody can fix the system anymore without a console. So, you suggest that the mitigation method for the brute force attack through the execve system call should be different (not kill the process that exec). Any suggestions would be welcome to improve this feature. > So probably the mitigation means that most such attacks eventually lead > to a panic because they will reach init sooner or later. I think it is not correct. As explain earlier the current mitigation method only works over the process that crashes and their parent. It not go up in the processes tree until reach the init process. > Another somewhat worrying case is some bug that kills KVM guests. > So if the bug can be triggered frequently you can kill all the > virtualization management infrastructure. Well, we need to work to avoid false positives. > I don't remember seeing a discussion of such drastic consequences in > your description. It might be ok depending on the use case, > but people certainly need to be aware of it. > > It's probably not something you want to have enabled by default ever. > > -Andi > Thanks, John Wood
next prev parent reply other threads:[~2021-03-07 18:06 UTC|newest] Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-02-27 15:30 [PATCH v5 0/8] Fork brute force attack mitigation John Wood 2021-02-27 15:30 ` [PATCH v5 1/8] security: Add LSM hook at the point where a task gets a fatal signal John Wood 2021-02-27 15:30 ` [PATCH v5 2/8] security/brute: Define a LSM and manage statistical data John Wood 2021-03-02 5:49 ` [security/brute] cfe92ab6a3: WARNING:inconsistent_lock_state kernel test robot 2021-03-02 18:39 ` John Wood 2021-02-27 15:30 ` [PATCH v5 3/8] securtiy/brute: Detect a brute force attack John Wood 2021-02-27 15:30 ` [PATCH v5 4/8] security/brute: Fine tuning the attack detection John Wood 2021-02-27 15:30 ` [PATCH v5 5/8] security/brute: Mitigate a brute force attack John Wood 2021-03-11 20:32 ` peter enderborg 2021-03-12 16:19 ` John Wood 2021-02-27 15:30 ` [PATCH v5 6/8] selftests/brute: Add tests for the Brute LSM John Wood 2021-02-27 15:30 ` [PATCH v5 7/8] Documentation: Add documentation " John Wood 2021-02-28 18:56 ` Andi Kleen 2021-03-02 18:31 ` John Wood 2021-03-07 15:19 ` Andi Kleen 2021-03-07 16:45 ` John Wood 2021-03-07 17:25 ` Andi Kleen 2021-03-07 18:05 ` John Wood [this message] 2021-03-07 22:49 ` Andi Kleen 2021-03-09 18:40 ` John Wood 2021-03-11 18:22 ` John Wood 2021-03-11 20:08 ` Andi Kleen 2021-03-12 17:47 ` John Wood 2021-03-11 20:05 ` Andi Kleen 2021-03-12 17:54 ` John Wood 2021-02-27 15:30 ` [PATCH v5 8/8] MAINTAINERS: Add a new entry " John Wood 2021-02-27 18:44 ` [PATCH v5 0/8] Fork brute force attack mitigation John Wood
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20210307180541.GA17108@ubuntu \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --subject='Re: [PATCH v5 7/8] Documentation: Add documentation for the Brute LSM' \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).