Re: [PATCH] [RFC] Deter exploit bruteforcing

Pavel Machek
2015-01-02T22:29:40Z

On Fri 2015-01-02 22:40:14, Richard Weinberger wrote:
> Am 02.01.2015 um 20:46 schrieb Pavel Machek:
> >>> Does this break trinity, crashme, and similar programs?
> >>
> >> If they fork() without execve() and a child dies very fast the next fork()
> >> will be throttled.
> >> This is why I'd like to make this feature disabled by default.
> >>
> >>> Can you detect it died due to the stack canary? Then, the patch might
> >>> be actually acceptable.
> >>
> >> I don't think so as this is glibc specific.
> >
> > Can the slowdown be impelmented in glibc, then?
>
> glibc has a lot of asserts where it can detect stack smashing and kills the
> current process using abort(). Here it could of course also call
> sleep().

Please do it in glibc, then.

> > If not, can glibc provide enough information to the kernel to allow us
> > to do the right thing?
>
> IMHO we should not strictly focus on the stack canary.

IMO we should. We want it enabled by default.
Pavel
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html