Re: [RFC PATCH 5/6] security/fbfam: Detect a fork brute force attack

2020-09-15 Thread John Wood
On Mon, Sep 14, 2020 at 09:42:37PM +0200, Jann Horn wrote: > On Sun, Sep 13, 2020 at 7:55 PM John Wood wrote: > > On Thu, Sep 10, 2020 at 11:10:38PM +0200, Jann Horn wrote: > > > > + delta_jiffies = get_jiffies_64() - stats->jiffies; > > > > + delta_time = jiffies64_to_msecs(delta_jiff

Re: [RFC PATCH 5/6] security/fbfam: Detect a fork brute force attack

2020-09-15 Thread John Wood
Hi, On Mon, Sep 14, 2020 at 09:39:10PM +0200, Jann Horn wrote: > On Sun, Sep 13, 2020 at 6:56 PM John Wood wrote: > > On Fri, Sep 11, 2020 at 02:01:56AM +0200, Jann Horn wrote: > > > On Fri, Sep 11, 2020 at 1:49 AM Kees Cook wrote: > > > > On Thu, Sep 10, 2020 at 01:21:06PM -0700, Kees Cook wrot

Re: [RFC PATCH 5/6] security/fbfam: Detect a fork brute force attack

2020-09-14 Thread Jann Horn
On Sun, Sep 13, 2020 at 7:55 PM John Wood wrote: > On Thu, Sep 10, 2020 at 11:10:38PM +0200, Jann Horn wrote: > > On Thu, Sep 10, 2020 at 10:22 PM Kees Cook wrote: > > > To detect a fork brute force attack it is necessary to compute the > > > crashing rate of the application. This calculation is

Re: [RFC PATCH 5/6] security/fbfam: Detect a fork brute force attack

2020-09-14 Thread Jann Horn
On Sun, Sep 13, 2020 at 6:56 PM John Wood wrote: > On Fri, Sep 11, 2020 at 02:01:56AM +0200, Jann Horn wrote: > > On Fri, Sep 11, 2020 at 1:49 AM Kees Cook wrote: > > > On Thu, Sep 10, 2020 at 01:21:06PM -0700, Kees Cook wrote: > > > > diff --git a/fs/coredump.c b/fs/coredump.c > > > > index 76e7

Re: [RFC PATCH 5/6] security/fbfam: Detect a fork brute force attack

2020-09-13 Thread John Wood
Hi, On Thu, Sep 10, 2020 at 11:10:38PM +0200, Jann Horn wrote: > On Thu, Sep 10, 2020 at 10:22 PM Kees Cook wrote: > > To detect a fork brute force attack it is necessary to compute the > > crashing rate of the application. This calculation is performed in each > > fatal fail of a task, or in oth

Re: [RFC PATCH 5/6] security/fbfam: Detect a fork brute force attack

2020-09-13 Thread John Wood
Hi, On Fri, Sep 11, 2020 at 02:01:56AM +0200, Jann Horn wrote: > On Fri, Sep 11, 2020 at 1:49 AM Kees Cook wrote: > > On Thu, Sep 10, 2020 at 01:21:06PM -0700, Kees Cook wrote: > > > diff --git a/fs/coredump.c b/fs/coredump.c > > > index 76e7c10edfc0..d4ba4e1828d5 100644 > > > --- a/fs/coredump.c

Re: [RFC PATCH 5/6] security/fbfam: Detect a fork brute force attack

2020-09-10 Thread Jann Horn
On Fri, Sep 11, 2020 at 1:49 AM Kees Cook wrote: > On Thu, Sep 10, 2020 at 01:21:06PM -0700, Kees Cook wrote: > > From: John Wood > > > > To detect a fork brute force attack it is necessary to compute the > > crashing rate of the application. This calculation is performed in each > > fatal fail o

Re: [RFC PATCH 5/6] security/fbfam: Detect a fork brute force attack

2020-09-10 Thread Kees Cook
On Thu, Sep 10, 2020 at 01:21:06PM -0700, Kees Cook wrote: > From: John Wood > > To detect a fork brute force attack it is necessary to compute the > crashing rate of the application. This calculation is performed in each > fatal fail of a task, or in other words, when a core dump is triggered. >

Re: [RFC PATCH 5/6] security/fbfam: Detect a fork brute force attack

2020-09-10 Thread Jann Horn
On Thu, Sep 10, 2020 at 10:22 PM Kees Cook wrote: > To detect a fork brute force attack it is necessary to compute the > crashing rate of the application. This calculation is performed in each > fatal fail of a task, or in other words, when a core dump is triggered. > If this rate shows that the a

[RFC PATCH 5/6] security/fbfam: Detect a fork brute force attack

2020-09-10 Thread Kees Cook
From: John Wood To detect a fork brute force attack it is necessary to compute the crashing rate of the application. This calculation is performed in each fatal fail of a task, or in other words, when a core dump is triggered. If this rate shows that the application is crashing quickly, there is