On Fri, Jun 01 2007, Daniel Hazelton wrote:
> On Friday 01 June 2007 02:48:59 Anand Jahagirdar wrote:
> > On 5/31/07, Jens Axboe <[email protected]> wrote:
> > > On Thu, May 31 2007, Anand Jahagirdar wrote:
> > > > 2) Printk message in my patch will definitely help Administrator/Root
> > > > User to detect which particular user is trying fork bombing attack on
> > > > his machine by looking at /var/log/messages or dmesg . he can take
> > > > action against that particular user and kill his processes.
> > >
> > > You just opened a DoS possibility for any user, they can now flood the
> > > syslog instead.
> >
> > Jens Axboe
> >
> > when they try to flood the syslog using fork bombing attack,
> > their messge will be printed only once in syslog and it will show how
> > many times it has repeated. due to this he will not able to flood the
> > syslog.and i am using only one single variable in my printk messge so
> > it is quite not possible to flood the syslog.
> >
> > am i missing something??
> >
> > anand
>
> Most definately. Each printk() call outputs to syslog - which means
> that every time your code outputs its message there is another line in
> the logs. It then becomes possible to use that to flood the syslog.
I think Anand is assuming that because syslog may coalesce identical
messages into "repeated foo times" in the messages file, that it's not a
dos. That is of course wrong.
--
Jens Axboe
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
