kernel-hardening.lists.openwall.com archive mirror
 help / color / mirror / Atom feed
From: Andi Kleen <ak@linux.intel.com>
To: John Wood <john.wood@gmx.com>
Cc: Kees Cook <keescook@chromium.org>, Jann Horn <jannh@google.com>,
	Randy Dunlap <rdunlap@infradead.org>,
	Jonathan Corbet <corbet@lwn.net>,
	James Morris <jmorris@namei.org>, Shuah Khan <shuah@kernel.org>,
	"Serge E. Hallyn" <serge@hallyn.com>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org,
	linux-security-module@vger.kernel.org,
	linux-kselftest@vger.kernel.org,
	kernel-hardening@lists.openwall.com
Subject: Re: [PATCH v5 7/8] Documentation: Add documentation for the Brute LSM
Date: Sun, 7 Mar 2021 14:49:27 -0800	[thread overview]
Message-ID: <20210307224927.GT472138@tassilo.jf.intel.com> (raw)
In-Reply-To: <20210307180541.GA17108@ubuntu>

On Sun, Mar 07, 2021 at 07:05:41PM +0100, John Wood wrote:
> On Sun, Mar 07, 2021 at 09:25:40AM -0800, Andi Kleen wrote:
> > > processes created from it will be killed. If the systemd restart the network
> > > daemon and it will crash again, then the systemd will be killed. I think this
> > > way the attack is fully mitigated.
> >
> > Wouldn't that panic the system? Killing init is usually a panic.
> 
> The mitigation acts only over the process that crashes (network daemon) and the
> process that exec() it (systemd). This mitigation don't go up in the processes
> tree until reach the init process.

Most daemons have some supervisor that respawns them when they crash. 
(maybe read up on "supervisor trees" if you haven't, it's a standard concept)

That's usually (but not) always init, as in systemd. There might be something
inbetween it and init, but likely init would respawn the something in between
it it. One of the main tasks of init is to respawn things under it.

If you have a supervisor tree starting from init the kill should eventually
travel up to init.

At least that's the theory. Do you have some experiments that show
this doesn't happen?

> 
> Note: I am a kernel newbie and I don't know if the systemd is init. Sorry if it
> is a stupid question. AFAIK systemd is not the init process (the first process
> that is executed) but I am not sure.

At least the part of systemd that respawns is often (but not always) init.

> 
> >
> > > > Or if it's a interactive login you log in again.
> > >
> > > First the login will be killed (if it fails with a fatal signal) and if it is
> > > restarted, the process that exec() it again will be killed. In this case I think
> > > that the threat is also completely mitigated.
> >
> > Okay so sshd will be killed. And if it gets restarted eventually init,
> > so panic again.
> 
> In this scenario the process that exec() the login will be killed (sshd
> process). But I think that sshd is not the init process. So no panic.

sshd would be respawned by the supervisor, which is likely init.

> > That's a fairly drastic consequence because even without panic
> > it means nobody can fix the system anymore without a console.
> 
> So, you suggest that the mitigation method for the brute force attack through
> the execve system call should be different (not kill the process that exec).
> Any suggestions would be welcome to improve this feature.

If the system is part of some cluster, then panicing on attack or failure
could be a reasonable reaction. Some other system in the cluster should
take over. There's also a risk that all the systems get taken
out quickly one by one, in this case you might still need something
like the below.

But it's something that would need to be very carefully considered
for the environment.

The other case is when there isn't some fallback, as in a standalone
machine.

It could be only used when the supervisor daemons are aware of it.
Often they already have respawn limits, but would need to make sure they
trigger before your algorithm trigger. Or maybe some way to opt-out 
per process.  Then the DoS would be only against that process, but
not everything on the machine. 

So I think it needs more work on the user space side for most usages.

-Andi

  reply	other threads:[~2021-03-07 22:49 UTC|newest]

Thread overview: 27+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-02-27 15:30 [PATCH v5 0/8] Fork brute force attack mitigation John Wood
2021-02-27 15:30 ` [PATCH v5 1/8] security: Add LSM hook at the point where a task gets a fatal signal John Wood
2021-02-27 15:30 ` [PATCH v5 2/8] security/brute: Define a LSM and manage statistical data John Wood
2021-03-02  5:49   ` [security/brute] cfe92ab6a3: WARNING:inconsistent_lock_state kernel test robot
2021-03-02 18:39     ` John Wood
2021-02-27 15:30 ` [PATCH v5 3/8] securtiy/brute: Detect a brute force attack John Wood
2021-02-27 15:30 ` [PATCH v5 4/8] security/brute: Fine tuning the attack detection John Wood
2021-02-27 15:30 ` [PATCH v5 5/8] security/brute: Mitigate a brute force attack John Wood
2021-03-11 20:32   ` peter enderborg
2021-03-12 16:19     ` John Wood
2021-02-27 15:30 ` [PATCH v5 6/8] selftests/brute: Add tests for the Brute LSM John Wood
2021-02-27 15:30 ` [PATCH v5 7/8] Documentation: Add documentation " John Wood
2021-02-28 18:56   ` Andi Kleen
2021-03-02 18:31     ` John Wood
2021-03-07 15:19       ` Andi Kleen
2021-03-07 16:45         ` John Wood
2021-03-07 17:25           ` Andi Kleen
2021-03-07 18:05             ` John Wood
2021-03-07 22:49               ` Andi Kleen [this message]
2021-03-09 18:40                 ` John Wood
2021-03-11 18:22                   ` John Wood
2021-03-11 20:08                     ` Andi Kleen
2021-03-12 17:47                       ` John Wood
2021-03-11 20:05                   ` Andi Kleen
2021-03-12 17:54                     ` John Wood
2021-02-27 15:30 ` [PATCH v5 8/8] MAINTAINERS: Add a new entry " John Wood
2021-02-27 18:44 ` [PATCH v5 0/8] Fork brute force attack mitigation John Wood

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210307224927.GT472138@tassilo.jf.intel.com \
    --to=ak@linux.intel.com \
    --cc=corbet@lwn.net \
    --cc=gregkh@linuxfoundation.org \
    --cc=jannh@google.com \
    --cc=jmorris@namei.org \
    --cc=john.wood@gmx.com \
    --cc=keescook@chromium.org \
    --cc=kernel-hardening@lists.openwall.com \
    --cc=linux-doc@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-kselftest@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=rdunlap@infradead.org \
    --cc=serge@hallyn.com \
    --cc=shuah@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).