Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Fri, 12 Mar 2021 18:47:51 +0100
From:   John Wood <john.wood@gmx.com>
To:     Andi Kleen <ak@linux.intel.com>
Cc:     John Wood <john.wood@gmx.com>, Kees Cook <keescook@chromium.org>,
        Jann Horn <jannh@google.com>,
        Randy Dunlap <rdunlap@infradead.org>,
        Jonathan Corbet <corbet@lwn.net>,
        James Morris <jmorris@namei.org>,
        Shuah Khan <shuah@kernel.org>,
        "Serge E. Hallyn" <serge@hallyn.com>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org,
        linux-security-module@vger.kernel.org,
        linux-kselftest@vger.kernel.org,
        kernel-hardening@lists.openwall.com
Subject: Re: [PATCH v5 7/8] Documentation: Add documentation for the Brute LSM
Message-ID: <20210312174751.GB3103@ubuntu>
References: <878s78dnrm.fsf@linux.intel.com>
 <20210302183032.GA3049@ubuntu>
 <20210307151920.GR472138@tassilo.jf.intel.com>
 <20210307164520.GA16296@ubuntu>
 <20210307172540.GS472138@tassilo.jf.intel.com>
 <20210307180541.GA17108@ubuntu>
 <20210307224927.GT472138@tassilo.jf.intel.com>
 <20210309184054.GA3058@ubuntu>
 <20210311182252.GA3349@ubuntu>
 <20210311200811.GH203350@tassilo.jf.intel.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20210311200811.GH203350@tassilo.jf.intel.com>
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Thu, Mar 11, 2021 at 12:08:11PM -0800, Andi Kleen wrote:
> > When a brute force attack is detected through the fork or execve syste=
m call,
> > all the tasks involved in the attack will be killed with the exception=
 of the
> > init task (task with pid equal to zero). Now, and only if the init tas=
k is
> > involved in the attack, block the fork system call from the init proce=
ss during
> > a user defined time (using a sysctl attribute). This way the brute for=
ce attack
> > is mitigated and the system does not panic.
>
> That means nobody can log in and fix the system during that time.
>
> Would be better to have that policy in init. Perhaps add some way
> that someone doing wait*() can know the exit was due this mitigation
> (and not something way) Then they could disable respawning of that daemo=
n.

Great. So, if we use wait*() to inform userspace that the exit of a proces=
s was
due to a brute force attack then, the supervisors (not only init) can adop=
t the
necessary policy in each case. This also allow us to deal with the respawn=
ed
daemons.

As a summary of this useful discussion:

- When a brute force attack is detected through the fork or execve system =
call
  all the offending tasks involved in the attack will be killed. Due to th=
e
  mitigation normally not reach init, do nothing special in this case -> t=
he
  system will panic when we kill init.

- Use wait*() to inform userspace that every process killed by the mitigat=
ion
  has exited due to a brute force attack mitigation. So, each supervisor c=
an
  adopt their own policy regarding respawned daemons.

I will work in that direction for the next version.

Thanks a lot for your time, proposals, guidance and solutions.
John Wood