From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.5 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 179C4C4727E for ; Fri, 2 Oct 2020 00:31:26 +0000 (UTC) Received: from shelob.surriel.com (shelob.surriel.com [96.67.55.147]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 3BCCA206E3 for ; Fri, 2 Oct 2020 00:31:22 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=vt-edu.20150623.gappssmtp.com header.i=@vt-edu.20150623.gappssmtp.com header.b="XMTkGH7i" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 3BCCA206E3 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=vt.edu Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kernelnewbies-bounces@kernelnewbies.org Received: from localhost ([::1] helo=shelob.surriel.com) by shelob.surriel.com with esmtp (Exim 4.94) (envelope-from ) id 1kO8yV-0005dC-EM; Thu, 01 Oct 2020 20:31:03 -0400 Received: from mail-qk1-x72b.google.com ([2607:f8b0:4864:20::72b]) by shelob.surriel.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.94) (envelope-from ) id 1kO8yU-0005cx-14 for kernelnewbies@kernelnewbies.org; Thu, 01 Oct 2020 20:31:02 -0400 Received: by mail-qk1-x72b.google.com with SMTP id q5so361186qkc.2 for ; Thu, 01 Oct 2020 17:31:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=vt-edu.20150623.gappssmtp.com; s=20150623; h=sender:from:to:cc:subject:in-reply-to:references:mime-version :content-transfer-encoding:date:message-id; bh=tjS7KrQHCBa0ZTdfNQCgIln1MWTZJtJPjyNZXQfEDdI=; b=XMTkGH7iBthqhIlIiaU5iQWRESyWCPUdY+bfjkQCVqu+rm30zqdAZnDmO8fBvYK2oC dtLfzRaubUhpAOLB5SwJISYfFgQUVLtAUmKpk7rD+x9wXpplhhZv+EYv9NiEbQOysAUG OLWnrVhkK5hob1vo3DHQpjWe8p+X6TA0KWpbfSBUrAKkSZefHXURk+Ub/N2T5vWODYDZ GE6DS7z9Sn3P+09rhsCkmIKzW0P1EdJl+pg/bAbxA+3hNLVQWWDZYYLvstJWYrtqj3ZC 97tteO1hsKRBiYb2+6OD8kvhtsYgISrjNYbC3QhRugsCRc7Ey9QM96EdUexiVJ5lIWJm Z1qw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:in-reply-to:references :mime-version:content-transfer-encoding:date:message-id; bh=tjS7KrQHCBa0ZTdfNQCgIln1MWTZJtJPjyNZXQfEDdI=; b=XJiJUn8N4tAD6XXCVF9C00Pwg5+xZCg4ijg0/w3kKgcErSXWlPshJxzJHLv7gbfb5Q Y2CKAjfC6dcjAfOF8cMpAMJAxEUcmJAYbsiYbY1wyIjV0iC+jF5o1WHpti9wIWfsY692 cJDBh8hi/y/2M/vKOspNw7dMMPyrrArRra4+TJANV6tApQCVMNCmYGQhh0BORPF4ltZ+ e2S6ICJ0bUpETxnqyvX2mFw6J8II4OWW+mXBAOc91i3LmM85HcWUITOH5CwbTqkiQR2+ 2dIzK+rvAENh3vqMv6vrgeaGp44gqI1ToEmc676bd7/KHfA8GerD2lJ799zI3XdVIT23 Wt6w== X-Gm-Message-State: AOAM5317CAVhbpptZ2fFZ5jzyaL6n3jmHiVokrs1YiOojnvj6AvIsFd9 uCXVRC/puq1jx3COfo1zQVdUbA== X-Google-Smtp-Source: ABdhPJzs/B6opMM1wYoMWy5/sj4g3RsMWmAWwhYVpiulj5dtLJV1HMQfzNc/r6JYwUiYpFXtFziySg== X-Received: by 2002:a37:51c2:: with SMTP id f185mr10194662qkb.171.1601598601019; Thu, 01 Oct 2020 17:30:01 -0700 (PDT) Received: from turing-police ([2601:5c0:c000:a8c1::359]) by smtp.gmail.com with ESMTPSA id e9sm7949497qkb.8.2020.10.01.17.29.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 01 Oct 2020 17:29:59 -0700 (PDT) From: "Valdis Kl=?utf-8?Q?=c4=93?=tnieks" X-Google-Original-From: "Valdis Kl=?utf-8?Q?=c4=93?=tnieks" X-Mailer: exmh version 2.9.0 11/07/2018 with nmh-1.7+dev To: John Wood Subject: Re: Read the "real_parent" field of task_struct In-Reply-To: <20201001174902.GA3046@ubuntu> References: <20200925161142.GA2857@ubuntu> <53033.1601467187@turing-police> <20201001174902.GA3046@ubuntu> Mime-Version: 1.0 Date: Thu, 01 Oct 2020 20:29:58 -0400 Message-ID: <187490.1601598598@turing-police> Cc: kernelnewbies@kernelnewbies.org X-BeenThere: kernelnewbies@kernelnewbies.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Learn about the Linux kernel List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============2022663165877626365==" Errors-To: kernelnewbies-bounces@kernelnewbies.org --===============2022663165877626365== Content-Type: multipart/signed; boundary="==_Exmh_1601598598_12263P"; micalg=pgp-sha1; protocol="application/pgp-signature" Content-Transfer-Encoding: 7bit --==_Exmh_1601598598_12263P Content-Type: text/plain; charset=us-ascii On Thu, 01 Oct 2020 19:49:02 +0200, John Wood said: > Idea: The purpose of my LSM is to detect and mitigate a fork brute force > attack. To do so, I need a hierarchy of fork processes. In other words, there > is a pointer in the task_struct structure that points to an statistics data > structure. This pointer is copied to the child process when a process forks. > This way, all the tasks that fork with the same root share the same statistics. > These statistics allow to compute the application crashing period and detect > the attack. How is this any better than applying a ulimit to the userid, and using the existing audit subsystem for reporting the attack, which is what that subsystem was designed for? > But there is the case when the task 0 is allocated. In this case it's not > possible to copy the parent pointer to the statistical data. The task 0 don't > have parent. In this scenario a new statistics structure need to be allocated. At that point, your LSM probably hasn't been initialized yet. If your LSM is being called before task 0 (let alone task 1) is created, there's probably something wonky going on. Are you seeing this happen on an actual system? --==_Exmh_1601598598_12263P Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Comment: Exmh version 2.9.0 11/07/2018 iQIVAwUBX3Z0hQdmEQWDXROgAQLN9BAAnMeR6NywP7Hye3WyOjzgCG8KvPC2Xa2v op8TWFXoiGgLgmc5o8/sKNR4ZzFz7JuoY/7vTZU6qAHXg9kxaAq5BjLPhsg9M4Ns Am9IsZbeFeKwCDfOj2biuOn4B/H6djGsvYmfrTVDGb5UGtcpOZD5CUL04U7mS8uD yExxIDVqzMiiqjTJn6GirjO9jnHQo/XdRrEZEWk7g+WV5SNRLixHdM8vsu12TH8e Id1G+ISQH1rHRCOXGLhT/wscPFu/86XFd9FHjHS73ay9SZpHfa/5nhyFqkzG5zW3 7QpoCB0d2jlTVQSxpoKjDkjuE6CSHQACVAprE7xR9YVUOjBRn+lVpVNGRa3Sat4N XKayLcMoTTLD1eWIFXHJmWc66WoxaB7hF7eoyI9Wn2wjDudGPwrlF0mwFW3KWFjU 0WvezfI5X7G3B7vvhsMLBS0vANIJSA+EwE7LrXnAYB4si/JQvTSmSsUteyQeUE8R WU8Lp40fAVVPylyf2wS1/jxQON/lNQuU0Rkfeo7DrlmjZmU2IzSHp5v3K8brO4tJ 08zyTrAyUpsbycbbpEwaD225bFgxbwdPjwWtmwxc6bzq2kBdXrDLNylK36nVP+ZN qCrnJhw7KjTk9WHykwxQ+Xlh//5ayY9MpqQbY9UucIfOgmUKaHMCfyPKC6WtY0cQ Y6NdldK+Olk= =wv8N -----END PGP SIGNATURE----- --==_Exmh_1601598598_12263P-- --===============2022663165877626365== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Kernelnewbies mailing list Kernelnewbies@kernelnewbies.org https://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies --===============2022663165877626365==--