Re: fs: sandboxed process brings host down

[Al Viro <viro@ZenIV.linux.org.uk>]

On Fri, Jan 22, 2016 at 10:38:40PM +0100, Dmitry Vyukov wrote:

> My 2GB VM dies at around just 10-th iteration, is it normal?
> Each iteration consumes several hundreds of megs of kernel memory. And
> there seems to be exponential slowdown at around 5-th iteration.
> I understand that there can be lots of forms of a local DoS. But there
> seems to be something pathological about this particular one. And it
> happens only with sandboxing that is meant to reduce DoS
> possibilities...

Sandboxing == giving attacker to do mount without being root.

As for exponential - sure, you double the amount of mounts on each step
(if not quadruple - I don't have your code in front of me right now,
but ISTR two mount --rbind in there).  More obvious form would be
for i in `seq 64`; do mkdir /tmp/$i; mount --rbind / /tmp/$i; done - there
the entire tree would be visible (and visibly exponential by the number of
iterations).

I doubt that the first iteration chews hundreds of megs, BTW.  If you
really get two mount --rbind per iteration, you would have about a million-fold
increase of the number of mounts after ten iterations, and having that chew
2Gb is quite plausible; in that case the first iteration would eat about 10K
or so...