Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Thu, 11 Mar 2021 19:22:52 +0100
From:   John Wood <john.wood@gmx.com>
To:     Andi Kleen <ak@linux.intel.com>
Cc:     John Wood <john.wood@gmx.com>, Kees Cook <keescook@chromium.org>,
        Jann Horn <jannh@google.com>,
        Randy Dunlap <rdunlap@infradead.org>,
        Jonathan Corbet <corbet@lwn.net>,
        James Morris <jmorris@namei.org>,
        Shuah Khan <shuah@kernel.org>,
        "Serge E. Hallyn" <serge@hallyn.com>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org,
        linux-security-module@vger.kernel.org,
        linux-kselftest@vger.kernel.org,
        kernel-hardening@lists.openwall.com
Subject: Re: [PATCH v5 7/8] Documentation: Add documentation for the Brute LSM
Message-ID: <20210311182252.GA3349@ubuntu>
References: <20210227153013.6747-1-john.wood@gmx.com>
 <20210227153013.6747-8-john.wood@gmx.com>
 <878s78dnrm.fsf@linux.intel.com>
 <20210302183032.GA3049@ubuntu>
 <20210307151920.GR472138@tassilo.jf.intel.com>
 <20210307164520.GA16296@ubuntu>
 <20210307172540.GS472138@tassilo.jf.intel.com>
 <20210307180541.GA17108@ubuntu>
 <20210307224927.GT472138@tassilo.jf.intel.com>
 <20210309184054.GA3058@ubuntu>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20210309184054.GA3058@ubuntu>
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

Hi,

On Tue, Mar 09, 2021 at 07:40:54PM +0100, John Wood wrote:
> On Sun, Mar 07, 2021 at 02:49:27PM -0800, Andi Kleen wrote:
>
> > So I think it needs more work on the user space side for most usages.
>
> Anyway, in the case that the supervisor is init then the system will pan=
ic. So,
> I think that we can add a prctl to avoid kill the parent task (the task =
that
> exec) and only block new fork system calls from this task. When this boo=
lean is
> set, any parent task that is involved in the attack will not be killed. =
In this
> case, any following forks will be blocked. This way the system will not =
crash.

Another proposal that I think suits better:

When a brute force attack is detected through the fork or execve system ca=
ll,
all the tasks involved in the attack will be killed with the exception of =
the
init task (task with pid equal to zero). Now, and only if the init task is
involved in the attack, block the fork system call from the init process d=
uring
a user defined time (using a sysctl attribute). This way the brute force a=
ttack
is mitigated and the system does not panic.

I think that this is a better solution than the other one since this is a =
per
system solution. And I believe that with a default value for the blocking =
time
(sysctl attribute) could be useful in a generic way (for most usages).

The proposal using prctl will need more actions from userspace and it is n=
ot a
generic one due to it is a per process solution.

> What do you think?

Thanks,
John Wood