Re: [PATCH v6 3/8] securtiy/brute: Detect a brute force attack

2021-03-22 Thread John Wood
Hi, On Sun, Mar 21, 2021 at 11:45:59AM -0700, Kees Cook wrote: > On Sun, Mar 21, 2021 at 04:01:18PM +0100, John Wood wrote: > > On Wed, Mar 17, 2021 at 07:57:10PM -0700, Kees Cook wrote: > > > On Sun, Mar 07, 2021 at 12:30:26PM +0100, John Wood wrote: > > Sorry, but I try to understand how to use

Re: [PATCH v6 3/8] securtiy/brute: Detect a brute force attack

2021-03-21 Thread Kees Cook
On Sun, Mar 21, 2021 at 04:01:18PM +0100, John Wood wrote: > On Wed, Mar 17, 2021 at 07:57:10PM -0700, Kees Cook wrote: > > On Sun, Mar 07, 2021 at 12:30:26PM +0100, John Wood wrote: > > > +static u64 brute_update_crash_period(struct brute_stats *stats, u64 now) > > > +{ > > > + u64

Re: [PATCH v6 3/8] securtiy/brute: Detect a brute force attack

2021-03-21 Thread Kees Cook
On Sat, Mar 20, 2021 at 04:34:06PM +0100, John Wood wrote: > On Wed, Mar 17, 2021 at 07:57:10PM -0700, Kees Cook wrote: > > On Sun, Mar 07, 2021 at 12:30:26PM +0100, John Wood wrote: > > > @@ -74,7 +84,7 @@ static struct brute_stats *brute_new_stats(void) > > > { > > > struct brute_stats

Re: [PATCH v6 3/8] securtiy/brute: Detect a brute force attack

2021-03-21 Thread John Wood
On Wed, Mar 17, 2021 at 07:57:10PM -0700, Kees Cook wrote: > On Sun, Mar 07, 2021 at 12:30:26PM +0100, John Wood wrote: > > +static u64 brute_update_crash_period(struct brute_stats *stats, u64 now) > > +{ > > + u64 current_period; > > + u64 last_crash_timestamp; > > + > > + spin_lock(>lock);

Re: [PATCH v6 3/8] securtiy/brute: Detect a brute force attack

2021-03-20 Thread John Wood
On Wed, Mar 17, 2021 at 07:57:10PM -0700, Kees Cook wrote: > On Sun, Mar 07, 2021 at 12:30:26PM +0100, John Wood wrote: > > @@ -74,7 +84,7 @@ static struct brute_stats *brute_new_stats(void) > > { > > struct brute_stats *stats; > > > > - stats = kmalloc(sizeof(struct brute_stats),

Re: [PATCH v6 3/8] securtiy/brute: Detect a brute force attack

2021-03-17 Thread Kees Cook
On Sun, Mar 07, 2021 at 12:30:26PM +0100, John Wood wrote: > To detect a brute force attack it is necessary that the statistics > shared by all the fork hierarchy processes be updated in every fatal > crash and the most important data to update is the application crash > period. To do so, use the

[PATCH v6 3/8] securtiy/brute: Detect a brute force attack

2021-03-07 Thread John Wood
To detect a brute force attack it is necessary that the statistics shared by all the fork hierarchy processes be updated in every fatal crash and the most important data to update is the application crash period. To do so, use the new "task_fatal_signal" LSM hook added in a previous step. The