kernel-hardening.lists.openwall.com archive mirror
 help / color / mirror / Atom feed
From: John Wood <john.wood@gmx.com>
To: peter enderborg <peter.enderborg@sony.com>,
	Kees Cook <keescook@chromium.org>, Jann Horn <jannh@google.com>,
	Randy Dunlap <rdunlap@infradead.org>,
	Jonathan Corbet <corbet@lwn.net>,
	James Morris <jmorris@namei.org>, Shuah Khan <shuah@kernel.org>
Cc: John Wood <john.wood@gmx.com>,
	"Serge E. Hallyn" <serge@hallyn.com>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org,
	linux-security-module@vger.kernel.org,
	linux-kselftest@vger.kernel.org,
	kernel-hardening@lists.openwall.com
Subject: Re: [PATCH v5 5/8] security/brute: Mitigate a brute force attack
Date: Fri, 12 Mar 2021 17:19:21 +0100	[thread overview]
Message-ID: <20210312161921.GA3103@ubuntu> (raw)
In-Reply-To: <5419ebe6-bb82-9b66-052b-0eefff93e5ae@sony.com>

Hi,

On Thu, Mar 11, 2021 at 09:32:47PM +0100, peter enderborg wrote:
> On 2/27/21 4:30 PM, John Wood wrote:
> > In order to mitigate a brute force attack all the offending tasks involved
> > in the attack must be killed. In other words, it is necessary to kill all
> > the tasks that share the fork and/or exec statistical data related to the
> > attack. Moreover, if the attack happens through the fork system call, the
> > processes that have the same group_leader that the current task (the task
> > that has crashed) must be avoided since they are in the path to be killed.
> >
> > When the SIGKILL signal is sent to the offending tasks, the function
> > "brute_kill_offending_tasks" will be called in a recursive way from the
> > task_fatal_signal LSM hook due to a small crash period. So, to avoid kill
> > again the same tasks due to a recursive call of this function, it is
> > necessary to disable the attack detection for the involved hierarchies.
>
> Would it not be useful for forensic reasons to be able to send SIGABRT and get the a coredump?

If there are many tasks involved in the attack we will generate a big number of
coredumps (one per task aborted). This can be solved if we send the SIGABRT to
terminate the first process found and send SIGKILL to terminate the remaining
processes. But I don't know if under this scenario we will get a core dump with
lack of information (the info related to the other processes).

Another scenario:

The process that crashes is the last in the fork hierarchy and triggers a brute
force attack mitigation. In this case it it not necessary to kill the process
that crashes since it is in the path to be killed. So, under this situation we
will not get a coredump (we don't send any signal). Lack of information again.

Currently, we show the name of the task that triggers the mitigation, the attack
type (fork or exec) and the name and pid of all the offending tasks involved in
the attack (the tasks that we kill). If it's necessary we can show more info.
What info do you think would be necessary?

Thanks,
John Wood

  reply	other threads:[~2021-03-12 16:20 UTC|newest]

Thread overview: 27+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-02-27 15:30 [PATCH v5 0/8] Fork brute force attack mitigation John Wood
2021-02-27 15:30 ` [PATCH v5 1/8] security: Add LSM hook at the point where a task gets a fatal signal John Wood
2021-02-27 15:30 ` [PATCH v5 2/8] security/brute: Define a LSM and manage statistical data John Wood
2021-03-02  5:49   ` [security/brute] cfe92ab6a3: WARNING:inconsistent_lock_state kernel test robot
2021-03-02 18:39     ` John Wood
2021-02-27 15:30 ` [PATCH v5 3/8] securtiy/brute: Detect a brute force attack John Wood
2021-02-27 15:30 ` [PATCH v5 4/8] security/brute: Fine tuning the attack detection John Wood
2021-02-27 15:30 ` [PATCH v5 5/8] security/brute: Mitigate a brute force attack John Wood
2021-03-11 20:32   ` peter enderborg
2021-03-12 16:19     ` John Wood [this message]
2021-02-27 15:30 ` [PATCH v5 6/8] selftests/brute: Add tests for the Brute LSM John Wood
2021-02-27 15:30 ` [PATCH v5 7/8] Documentation: Add documentation " John Wood
2021-02-28 18:56   ` Andi Kleen
2021-03-02 18:31     ` John Wood
2021-03-07 15:19       ` Andi Kleen
2021-03-07 16:45         ` John Wood
2021-03-07 17:25           ` Andi Kleen
2021-03-07 18:05             ` John Wood
2021-03-07 22:49               ` Andi Kleen
2021-03-09 18:40                 ` John Wood
2021-03-11 18:22                   ` John Wood
2021-03-11 20:08                     ` Andi Kleen
2021-03-12 17:47                       ` John Wood
2021-03-11 20:05                   ` Andi Kleen
2021-03-12 17:54                     ` John Wood
2021-02-27 15:30 ` [PATCH v5 8/8] MAINTAINERS: Add a new entry " John Wood
2021-02-27 18:44 ` [PATCH v5 0/8] Fork brute force attack mitigation John Wood

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210312161921.GA3103@ubuntu \
    --to=john.wood@gmx.com \
    --cc=corbet@lwn.net \
    --cc=gregkh@linuxfoundation.org \
    --cc=jannh@google.com \
    --cc=jmorris@namei.org \
    --cc=keescook@chromium.org \
    --cc=kernel-hardening@lists.openwall.com \
    --cc=linux-doc@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-kselftest@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=peter.enderborg@sony.com \
    --cc=rdunlap@infradead.org \
    --cc=serge@hallyn.com \
    --cc=shuah@kernel.org \
    --subject='Re: [PATCH v5 5/8] security/brute: Mitigate a brute force attack' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).