lkml.org 
[lkml]   [2013]   [Dec]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 1/9] Known exploit detection
On Fri, Dec 13, 2013 at 02:06:48PM +0100, Ingo Molnar wrote:
...
> In future the exploit() code could trigger actual active defensive
> measures, such as immediately freezing all tasks of that UID and
> blocking further fork()s/exec()s of that UID.
>
> Depending on how critical the security of the system is, such active
> measures might still be a preferable outcome even if there's a chance
> of false positives. (Such active measures that freeze the UID will
> also help with forensics, if the attack is indeed real.)

I would recommend adding the CVSS score or some other quantifiable
attribute to the exploit() call, eg:

exploit("CVE-2011-4330", 72);

Or, optionally, maintaining a lut of CVE -> severity number. Then the
user can decide how to respond to different levels of exploits.

So, >80 freezes all tasks of the UID, email user
>30, <80 emails user
<30 just logs it.

I'm swagging this, my point is the user needs a concrete, configurable
way to be alerted / respond.

thx,

Jason.


\
 
 \ /
  Last update: 2013-12-13 17:21    [W:0.138 / U:0.164 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site