Messages in this thread | | | Date | Mon, 23 Dec 1996 23:59:29 -0800 (PST) | From | Trevor Johnson <> | Subject | Re: NT vulnerable to attack on CPU |
| |
bofh@snoopy.virtual.net.au wrote: > I have written and run test programs such as that and not had any problems. > Your oops indicates that there is some bug in process handling in the kernel > you are running. Other versions of the Linux kernel do not have this bug.
Yes. When I ran the "wabbit" under 2.0.27, there were no oopses. The system slowed down greatly (to the point of being unusable) as the load average went up to 150 or so, but after I pressed control-c, everything returned to normal.
> for users. So I could set my system up so that the following command would > result in fork failing if the user already has 20 or more processes: >#echo 20 > /proc/sys/procs-per-user > > What do you think?
That sounds ideal.
> It doesn't. Use lshell and it'll work for all shells.
My /etc/lshell.conf has this:
root - // No limits for root default C60P30D20F24 // Default limits, 60 min's CPU time, 30 processes, 20Mb, 24 file descriptors
but I haven't configured it to run. Instead, I'm using the shadow suite, and /etc/limits contained:
# Format: # <username> <limits-string> # # default entry is '*' for username # # Valid flags are: # C: max core file size (KB) # D: max data size (KB) # F: maximum filesize (KB) # M: max locked-in-memory address space (KB) # N: max number of open files # R: max resident set size (KB) # S: max stack size (KB) # T: max CPU time (MIN) # U: max number of processes # L: max number of logins for this user # # the default entry #* L2 D6144 R2048 S2048 U32 N32 F16384 T5 C0 L12 D8192 R16384 S4096 U32 N64 C0 # another way of suspending a user login nobody L0 # this account has no limits root -
which was misconfigured (I'd forgotten the asterisk for the default entry), so the "limit" command in tcsh (from my own account) returned:
cputime unlimited filesize 1048576 kbytes datasize unlimited stacksize 8192 kbytes coredumpsize 0 kbytes memoryuse unlimited descriptors 256 memorylocked unlimited maxproc 256
under 2.0.27. Under 2.1.17, it looks the same, except that I'd applied Jared Mauch's patch to fd.c and limits.h, increasing the number of open file descriptors to 512.
After adding the asterisk to /etc/limits, I could run the fork bomb from my own account with no problems. The summary from "top":
11:56pm up 29 min, 2 users, load average: 24.30, 8.21, 3.69 52 processes: 20 sleeping, 32 running, 0 zombie, 0 stopped CPU states: 4.2% user, 95.6% system, 99.1% nice, 0.9% idle Mem: 62668K av, 12356K used, 50312K free, 10504K shrd, 872K buff Swap: 0K av, 0K used, 0K free 7300K cached
Here's my configuration for 2.1.17:
CONFIG_EXPERIMENTAL=y CONFIG_MODULES=y CONFIG_MODVERSIONS=y CONFIG_KERNELD=y CONFIG_NET=y CONFIG_PCI=y CONFIG_PCI_OPTIMIZE=y CONFIG_SYSVIPC=y CONFIG_BINFMT_AOUT=m CONFIG_BINFMT_ELF=y CONFIG_BINFMT_JAVA=m CONFIG_M486=y CONFIG_BLK_DEV_FD=m CONFIG_BLK_DEV_IDE=y CONFIG_BLK_DEV_IDEDISK=y CONFIG_BLK_DEV_LOOP=m CONFIG_INET=y CONFIG_PATH_MTU_DISCOVERY=y CONFIG_IP_NOSR=y CONFIG_IPV6=m CONFIG_LLC=y CONFIG_SCSI=m CONFIG_CHR_DEV_ST=m CONFIG_BLK_DEV_SR=m CONFIG_BLK_DEV_SR_VENDOR=y CONFIG_SCSI_CONSTANTS=y CONFIG_SCSI_AHA1542=m CONFIG_NETDEVICES=y CONFIG_NET_ETHERNET=y CONFIG_NET_ISA=y CONFIG_NE2000=m CONFIG_PPP=y CONFIG_SHAPER=m CONFIG_MINIX_FS=m CONFIG_EXT2_FS=y CONFIG_FAT_FS=y CONFIG_MSDOS_FS=m CONFIG_VFAT_FS=m CONFIG_UMSDOS_FS=m CONFIG_PROC_FS=y CONFIG_NFS_FS=m CONFIG_SMB_FS=m CONFIG_SMB_WIN95=y CONFIG_ISO9660_FS=m CONFIG_SERIAL=y CONFIG_PRINTER=m CONFIG_SOUND=m CONFIG_SB=y CONFIG_ADLIB=y CONFIG_YM3812=y CONFIG_LOWLEVEL_SOUND=y CONFIG_AWE32_SYNTH=y ___ Trevor Johnson <trevor@jpj.net>
| |