From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 70631C11F66 for ; Mon, 5 Jul 2021 12:52:36 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 58F27613E1 for ; Mon, 5 Jul 2021 12:52:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230456AbhGEMzM (ORCPT ); Mon, 5 Jul 2021 08:55:12 -0400 Received: from mail-40136.protonmail.ch ([185.70.40.136]:29575 "EHLO mail-40136.protonmail.ch" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231253AbhGEMzL (ORCPT ); Mon, 5 Jul 2021 08:55:11 -0400 Date: Mon, 05 Jul 2021 12:52:23 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pm.me; s=protonmail; t=1625489553; bh=dq32cO+ZKMc2KufqrF4+FnLvbFSGJWzWZn6wbfbMESE=; h=Date:To:From:Cc:Reply-To:Subject:In-Reply-To:References:From; b=NsJzHSo68u3RONXSa1dsHMZ0kieV61sNhU2UxI7md1kCzE+xhhP+TgNVVpxDRdRQb Sn3LLQT//Pmu3Ib0/flMZLDnR1bLKSB+7xpaeoo4JVSm14ld2ueHbTXw/Xt77Pel75 8i/oU66Blr2WCYv2KvXa31TJpaWuOv7TIpwxjmZqASWU1VVdbLLzZAAXD3edz9Evi/ j8DcH69GHS2ETAUUOXgVEEiT0ikHTY1FdFGNuOaEWHBrjsr3DT4ki70+lfwMuOiPt3 DVKHAEGwM9c9yY7xz9u1iKDGIagPe2Kb/ly9UAoWpctS+tNYsNKPEl1pLRosWbX28a nKzSr5FL3ojLw== To: John Wood From: Alexander Lobakin Cc: Alexander Lobakin , Kees Cook , Jann Horn , Jonathan Corbet , James Morris , "Serge E. Hallyn" , Shuah Khan , Thomas Gleixner , Ingo Molnar , Borislav Petkov , x86@kernel.org, "H. Peter Anvin" , Arnd Bergmann , Andi Kleen , valdis.kletnieks@vt.edu, Greg Kroah-Hartman , Randy Dunlap , Andrew Morton , linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-arch@vger.kernel.org, linux-hardening@vger.kernel.org, kernel-hardening@lists.openwall.com Reply-To: Alexander Lobakin Subject: Re: [PATCH v8 3/8] security/brute: Detect a brute force attack Message-ID: <20210705124446.45320-1-alobakin@pm.me> In-Reply-To: <20210704140108.GA2742@ubuntu> References: <20210701234807.50453-1-alobakin@pm.me> <20210702145954.GA4513@ubuntu> <20210702170101.16116-1-alobakin@pm.me> <20210703105928.GA2830@ubuntu> <20210704140108.GA2742@ubuntu> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-arch@vger.kernel.org From: John Wood Date: Sun, 4 Jul 2021 16:01:08 +0200 > On Sat, Jul 03, 2021 at 12:59:28PM +0200, John Wood wrote: > > Hi, > > > > On Fri, Jul 02, 2021 at 05:08:09PM +0000, Alexander Lobakin wrote: > > > > > > On the other hand, it leaves a potentional window for attackers to > > > perform brute force from xattr-incapable filesystems. So at the end > > > of the day I think that the current implementation (a strong > > > rejection of such filesystems) is way more secure than having > > > a fallback I proposed. > > > > I've been thinking more about this: that the Brute LSM depends on xattr > > support and I don't like this part. I want that brute force attacks can > > be detected and mitigated on every system (with minimal dependencies). > > So, now I am working in a solution without this drawback. I have some > > ideas but I need to work on it. > > I have been coding and testing a bit my ideas but: > > Trying to track the applications faults info using kernel memory ends up > in an easy to abuse system (denied of service due to large amount of memo= r=3D > y > in use) :( > > So, I continue with the v8 idea: xattr to track application crashes info. > > > > I'm planning to make a patch which will eliminate such weird rootfs > > > type selection and just always use more feature-rich tmpfs if it's > > > compiled in. So, as an alternative, you could add it to your series > > > as a preparatory change and just add a Kconfig dependency on > > > CONFIG_TMPFS && CONFIG_TMPFS_XATTR to CONFIG_SECURITY_FORK_BRUTE > > > without messing with any fallbacks at all. > > > What do you think? > > > > Great. But I hope this patch will not be necessary for Brute LSM :) > > My words are no longer valid ;) Ok, so here's the patch that prefers tmpfs for rootfs over ramfs if it's built-in (which is true for 99% of systems): [0] For now it hasn't been reviewed by anyone yet, will see. I'm running my system with this patch for several days already and there were no issues with rootfs or Brute so far. [0] https://lore.kernel.org/lkml/20210702233727.21301-1-alobakin@pm.me/ > Thanks, > John Wood Thanks, Al