lkml.org 
[lkml]   [2005]   [Mar]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: forkbombing Linux distributions
    Date
    On Mar 23, 2005, at 09:43, Jan Engelhardt wrote:
    >> brings down almost all linux distro's while other *nixes survives.
    >
    > Let's see if this can be confirmed.

    Here at my school we have the workstations running Debian testing. We
    have edited /etc/security/limits.conf to have a much more restrictive
    startup environment for user processes, limiting to 100 processes per
    user and clamping maximum CPU time to 4 hours per process. It's not
    failsafe, but we also have all of the kernel threads set at realtime
    levels, with the IRQ threads specifically set at SCHED_RR 99, and we
    have a sulogin-type process on tty12 at SCHED_RR 99.

    Even in the event of the worst kind of forkbomb, the terminal is as
    responsive as if nothing else were running and allows us to kill the
    offending processes easily, because when the scheduler refuses to
    interrupt the killall process to run anything else, no other forkbomb
    processes get started.

    I suppose a similar situation could be set up with a user-accessible
    server and a rate-limited SSH daemon if necessary, although a ttyS0
    console via a console server might work better. In any case, I think
    that while there could perhaps be a better interface for user-limits
    in the kernel, the existing one works fine for most purposes, when
    combined with appropriate administrative tools.

    Cheers,
    Kyle Moffett

    -----BEGIN GEEK CODE BLOCK-----
    Version: 3.12
    GCM/CS/IT/U d- s++: a18 C++++>$ UB/L/X/*++++(+)>$ P+++(++++)>$
    L++++(+++) E W++(+) N+++(++) o? K? w--- O? M++ V? PS+() PE+(-) Y+
    PGP+++ t+(+++) 5 X R? tv-(--) b++++(++) DI+ D+ G e->++++$ h!*()>++$ r
    !y?(-)
    ------END GEEK CODE BLOCK------


    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-04-06 13:30    [W:2.579 / U:0.344 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site