Re: Patch related with Fork Bombing Atack

[Jiri Kosina]

On Mon, 4 Jun 2007, Anand Jahagirdar wrote:

>            I am forwarding one improved patch related with Fork Bombing 
> Attack. This patch prints a message (only once) which alerts 
> administrator/root user about fork bombing attack. I created this patch 
> to implement my idea of informing administrator about fork bombing 
> attack on his machine only once.
>    This patch overcomes all drawbacks of my previous patch related with 
> fork bombing attack and helps administrator. added comments will 
> definitely help developers.

> +	/*
> +	 * following code prints a message which alerts administrator/root 		 * user about fork bombing Attack
> +	 */
> +	if ((atomic_read(&p->user->processes) >= (p->signal->rlim	[RLIMIT_NPROC].rlim_cur - 1)) && (atomic_read(&p->user->processes) < p->signal->rlim[RLIMIT_NPROC].rlim_cur)) {

Did this get malformed somehow? Looks like some successive lines got 
pasted together, or something.

> +        	if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) && p->user != &root_user) {
> +        		printk(KERN_CRIT"User with uid %d is crossing its Process limit\n",p->user->uid);
> +        	}
> +	}

Why not printk_ratelimit() here? Otherwise we have looped back to the 
possibility of user flooding the system logs, which has been already 
discussed in this thread, right? 

Also the { and } braces seem redundant.

Thanks,

-- 
Jiri Kosina
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/