Messages in this thread |  | | Date | Wed, 25 Dec 1996 13:57:19 +0200 (IST) | From | Andi Gutmans <> | Subject | Re: NT vulnerable to attack on CPU |
| |
put a cronjob to run a bomb and this won't have any effect. ie. linux limits (and prolly most unicees) are useless. I'm prolly going to hack the kernel a bit to do the following: certain limit for uid's < 1000 and certain limit for uid's > 1000 (users)
Andi
On Mon, 23 Dec 1996, Trevor Johnson wrote:
> > > bofh@snoopy.virtual.net.au wrote: > > I have written and run test programs such as that and not had any problems. > > Your oops indicates that there is some bug in process handling in the kernel > > you are running. Other versions of the Linux kernel do not have this bug. > > Yes. When I ran the "wabbit" under 2.0.27, there were no oopses. The > system slowed down greatly (to the point of being unusable) as the load > average went up to 150 or so, but after I pressed control-c, everything > returned to normal. > > > for users. So I could set my system up so that the following command would > > result in fork failing if the user already has 20 or more processes: > >#echo 20 > /proc/sys/procs-per-user > > > > What do you think? > > That sounds ideal. > > > It doesn't. Use lshell and it'll work for all shells. > > My /etc/lshell.conf has this: > > root - // No limits for root > default C60P30D20F24 // Default limits, 60 min's CPU time, 30 > processes, 20Mb, 24 file descriptors > > but I haven't configured it to run. Instead, I'm using the shadow suite, > and /etc/limits contained: > > # Format: > # <username> <limits-string> > # > # default entry is '*' for username > # > # Valid flags are: > # C: max core file size (KB) > # D: max data size (KB) > # F: maximum filesize (KB) > # M: max locked-in-memory address space (KB) > # N: max number of open files > # R: max resident set size (KB) > # S: max stack size (KB) > # T: max CPU time (MIN) > # U: max number of processes > # L: max number of logins for this user > # > # the default entry > #* L2 D6144 R2048 S2048 U32 N32 F16384 T5 C0 > L12 D8192 R16384 S4096 U32 N64 C0 > # another way of suspending a user login > nobody L0 > # this account has no limits > root - > > which was misconfigured (I'd forgotten the asterisk for the default > entry), so the "limit" command in tcsh (from my own account) returned: > > cputime unlimited > filesize 1048576 kbytes > datasize unlimited > stacksize 8192 kbytes > coredumpsize 0 kbytes > memoryuse unlimited > descriptors 256 > memorylocked unlimited > maxproc 256 > > under 2.0.27. Under 2.1.17, it looks the same, except that I'd applied > Jared Mauch's patch to fd.c and limits.h, increasing the number of open > file descriptors to 512. > > After adding the asterisk to /etc/limits, I could run the fork bomb from > my own account with no problems. The summary from "top": > > 11:56pm up 29 min, 2 users, load average: 24.30, 8.21, 3.69 > 52 processes: 20 sleeping, 32 running, 0 zombie, 0 stopped > CPU states: 4.2% user, 95.6% system, 99.1% nice, 0.9% idle > Mem: 62668K av, 12356K used, 50312K free, 10504K shrd, 872K buff > Swap: 0K av, 0K used, 0K free 7300K cached > > Here's my configuration for 2.1.17: > > CONFIG_EXPERIMENTAL=y > CONFIG_MODULES=y > CONFIG_MODVERSIONS=y > CONFIG_KERNELD=y > CONFIG_NET=y > CONFIG_PCI=y > CONFIG_PCI_OPTIMIZE=y > CONFIG_SYSVIPC=y > CONFIG_BINFMT_AOUT=m > CONFIG_BINFMT_ELF=y > CONFIG_BINFMT_JAVA=m > CONFIG_M486=y > CONFIG_BLK_DEV_FD=m > CONFIG_BLK_DEV_IDE=y > CONFIG_BLK_DEV_IDEDISK=y > CONFIG_BLK_DEV_LOOP=m > CONFIG_INET=y > CONFIG_PATH_MTU_DISCOVERY=y > CONFIG_IP_NOSR=y > CONFIG_IPV6=m > CONFIG_LLC=y > CONFIG_SCSI=m > CONFIG_CHR_DEV_ST=m > CONFIG_BLK_DEV_SR=m > CONFIG_BLK_DEV_SR_VENDOR=y > CONFIG_SCSI_CONSTANTS=y > CONFIG_SCSI_AHA1542=m > CONFIG_NETDEVICES=y > CONFIG_NET_ETHERNET=y > CONFIG_NET_ISA=y > CONFIG_NE2000=m > CONFIG_PPP=y > CONFIG_SHAPER=m > CONFIG_MINIX_FS=m > CONFIG_EXT2_FS=y > CONFIG_FAT_FS=y > CONFIG_MSDOS_FS=m > CONFIG_VFAT_FS=m > CONFIG_UMSDOS_FS=m > CONFIG_PROC_FS=y > CONFIG_NFS_FS=m > CONFIG_SMB_FS=m > CONFIG_SMB_WIN95=y > CONFIG_ISO9660_FS=m > CONFIG_SERIAL=y > CONFIG_PRINTER=m > CONFIG_SOUND=m > CONFIG_SB=y > CONFIG_ADLIB=y > CONFIG_YM3812=y > CONFIG_LOWLEVEL_SOUND=y > CONFIG_AWE32_SYNTH=y > ___ > Trevor Johnson <trevor@jpj.net> > > > >
|  |