[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 28 Feb 2021 10:56:45 -0800
From: Andi Kleen <ak@...ux.intel.com>
To: John Wood <john.wood@....com>
Cc: Kees Cook <keescook@...omium.org>, Jann Horn <jannh@...gle.com>, Randy Dunlap <rdunlap@...radead.org>, Jonathan Corbet <corbet@....net>, James Morris <jmorris@...ei.org>, Shuah Khan <shuah@...nel.org>, "Serge E. Hallyn" <serge@...lyn.com>, Greg Kroah-Hartman <gregkh@...uxfoundation.org>, linux-doc@...r.kernel.org, linux-kernel@...r.kernel.org, linux-security-module@...r.kernel.org, linux-kselftest@...r.kernel.org, kernel-hardening@...ts.openwall.com
Subject: Re: [PATCH v5 7/8] Documentation: Add documentation for the Brute LSM
John Wood <john.wood@....com> writes:
> +
> +To detect a brute force attack it is necessary that the statistics shared by all
> +the fork hierarchy processes be updated in every fatal crash and the most
> +important data to update is the application crash period.
So I haven't really followed the discussion and also not completely read
the patches (so apologies if that was already explained or is documented
somewhere else).
But what I'm missing here is some indication how much
memory these statistics can use up and how are they limited.
How much is the worst case extra memory consumption?
If there is no limit how is DoS prevented?
If there is a limit, there likely needs to be a way to throw out
information, and so the attack would just shift to forcing the kernel
to throw out this information before retrying.
e.g. if the data is hold for the parent shell: restart the parent
shell all the time.
e.g. if the data is hold for the sshd daemon used to log in:
Somehow cause sshd to respawn to discard the statistics.
Do I miss something here? How is that mitigated?
Instead of discussing all the low level tedious details of the
statistics it would be better to focus on these "high level"
problems here.
-Andi
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
