Hi,
On Sun, Feb 21, 2021 at 06:25:51PM -0800, Randy Dunlap wrote:
Hi--
On 2/21/21 7:49 AM, John Wood wrote:
+/**
- print_fork_attack_running() - Warn about a fork brute force attack.
- */
+static inline void print_fork_attack_running(void) +{
- pr_warn("Fork brute force attack detected [%s]\n", current->comm);
+}
Do these pr_warn() calls need to be rate-limited so that they don't flood the kernel log?
I think it is not necessary since when a brute force attack through the fork system call is detected, a fork warning appears only once. Then, all the offending tasks involved in the attack are killed. But if the parent try to run again the same app already killed, a new crash will trigger a brute force attack through the execve system call, then this parent is killed, and a new warning message appears. Now, the parent and childs are killed, the attacks are mitigated and only a few messages (one or two) have been shown in the kernel log.
Thanks, John Wood
+/**
- print_exec_attack_running() - Warn about an exec brute force attack.
- @stats: Statistical data shared by all the fork hierarchy processes.
- The statistical data shared by all the fork hierarchy processes cannot be
- NULL.
- Before showing the process name it is mandatory to find a process that holds
- a pointer to the exec statistics.
- Context: Must be called with tasklist_lock and brute_stats_ptr_lock held.
- */
+static void print_exec_attack_running(const struct brute_stats *stats) +{
- struct task_struct *p;
- struct brute_stats **p_stats;
- bool found = false;
- for_each_process(p) {
p_stats = brute_stats_ptr(p);if (*p_stats == stats) {found = true;break;}- if (WARN(!found, "No exec process\n"))
return;- pr_warn("Exec brute force attack detected [%s]\n", p->comm);
+}
thanks.
~Randy