Messages in this thread | | | Subject | Re: [PATCH v3 3/8] securtiy/brute: Detect a brute force attack | From | Randy Dunlap <> | Date | Sun, 21 Feb 2021 18:25:51 -0800 |
| |
Hi--
On 2/21/21 7:49 AM, John Wood wrote: > > Signed-off-by: John Wood <john.wood@gmx.com> > --- > security/brute/brute.c | 488 +++++++++++++++++++++++++++++++++++++++-- > 1 file changed, 474 insertions(+), 14 deletions(-) > > diff --git a/security/brute/brute.c b/security/brute/brute.c > index 70f812bb7763..645bd6e02638 100644 > --- a/security/brute/brute.c > +++ b/security/brute/brute.c
> +/** > + * print_fork_attack_running() - Warn about a fork brute force attack. > + */ > +static inline void print_fork_attack_running(void) > +{ > + pr_warn("Fork brute force attack detected [%s]\n", current->comm); > +}
Do these pr_warn() calls need to be rate-limited so that they don't flood the kernel log?
> +/** > + * print_exec_attack_running() - Warn about an exec brute force attack. > + * @stats: Statistical data shared by all the fork hierarchy processes. > + * > + * The statistical data shared by all the fork hierarchy processes cannot be > + * NULL. > + * > + * Before showing the process name it is mandatory to find a process that holds > + * a pointer to the exec statistics. > + * > + * Context: Must be called with tasklist_lock and brute_stats_ptr_lock held. > + */ > +static void print_exec_attack_running(const struct brute_stats *stats) > +{ > + struct task_struct *p; > + struct brute_stats **p_stats; > + bool found = false; > + > + for_each_process(p) { > + p_stats = brute_stats_ptr(p); > + if (*p_stats == stats) { > + found = true; > + break; > + } > } > + > + if (WARN(!found, "No exec process\n")) > + return; > + > + pr_warn("Exec brute force attack detected [%s]\n", p->comm); > +}
thanks. -- ~Randy
| |