[lkml]   [2007]   [Jun]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
SubjectPatch related with Fork Bobmbing Attack
Hello All
As per the discussion in the thread with subject as
Patch Related with Fork Bombing Attack on LKML, I request you for the
inclusion of my attached patch named "fork.patch".

Summery of the Patch:

This patch warns the administrator about the fork bombing attack
(whenever any user is crossing its process limit). I have used
printk_ratelimit function in this patch. This function helps to
prevent flooding of syslog and prints message as per the values set by
root user in following files:-

1) /proc/sys/kernel/printk_ratelimit:- This file contains value for,
how many times message should be printed in syslog.

2) /proc/sys/kernel/printk_ratelimit_burst: - This file contains value
for, after how much time message should be repeated.

This patch is really helpful for administrator/root user from security
point of view. They can take action against attacker by looking at
syslog messages related with fork bombing attack.

Added comments will definitely help developers.

Signed-Off-by: Anand Jahagirdar <>
Index: root/Desktop/a1/linux-2.6.17.tar.bz2_FILES/linux-2.6.17/kernel/fork.c
--- root.orig/Desktop/a1/linux-2.6.17.tar.bz2_FILES/linux-2.6.17/kernel/fork.c 2007-06-05 19:16:28.000000000 +0530
+++ root/Desktop/a1/linux-2.6.17.tar.bz2_FILES/linux-2.6.17/kernel/fork.c 2007-06-05 19:18:07.000000000 +0530
@@ -958,11 +958,18 @@
retval = -EAGAIN;

+ /*
+ * following code does not allow Non Root User to cross its process
+ * limit. it alerts administrator about fork bombing attack and prevents
+ * it.
+ */
if (atomic_read(&p->user->processes) >= p->signal->rlim[RLIMIT_NPROC].rlim_cur)
if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
- p->user != &root_user)
+ p->user != &root_user) {
+ if (printk_ratelimit())
+ printk(KERN_CRIT"User with uid %d is crossing its process limit\n",p->user->uid);
goto bad_fork_free;
+ }

 \ /
  Last update: 2007-06-12 18:53    [W:0.052 / U:0.668 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site