Messages in this thread | | | Date | Mon, 4 Jun 2007 16:58:41 +0200 (CEST) | From | Jiri Kosina <> | Subject | Re: Patch related with Fork Bombing Atack |
| |
On Mon, 4 Jun 2007, Anand Jahagirdar wrote:
> I am forwarding one improved patch related with Fork Bombing > Attack. This patch prints a message (only once) which alerts > administrator/root user about fork bombing attack. I created this patch > to implement my idea of informing administrator about fork bombing > attack on his machine only once. > This patch overcomes all drawbacks of my previous patch related with > fork bombing attack and helps administrator. added comments will > definitely help developers.
> + /* > + * following code prints a message which alerts administrator/root * user about fork bombing Attack > + */ > + if ((atomic_read(&p->user->processes) >= (p->signal->rlim [RLIMIT_NPROC].rlim_cur - 1)) && (atomic_read(&p->user->processes) < p->signal->rlim[RLIMIT_NPROC].rlim_cur)) {
Did this get malformed somehow? Looks like some successive lines got pasted together, or something.
> + if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) && p->user != &root_user) { > + printk(KERN_CRIT"User with uid %d is crossing its Process limit\n",p->user->uid); > + } > + }
Why not printk_ratelimit() here? Otherwise we have looped back to the possibility of user flooding the system logs, which has been already discussed in this thread, right?
Also the { and } braces seem redundant.
Thanks,
-- Jiri Kosina - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |