Re: Linux kernels DoSable by file-max limit

From: Aleksander Adamowski (oloat_private)
Date: Tue Jul 09 2002 - 02:35:58 PDT

  • Next message: Matthew Murphy: "ALERT: Working Resources BadBlue #2 (DoS, Heap Overflow)"

    Kurt Seifried wrote:
    
    >The available limits are:
    >
    >  core -- Limits the core file size (KB); usually set to 0 for most users to
    >prevent core dumps.
    >  data -- Maximum data size (KB).
    >  fsize -- Maximum file size (KB).
    >  memlock -- Maximum locked-in-memory address space (KB).
    >  nofile -- Maximum number of open files.
    >  rss -- Maximum resident set size (KB).
    >  stack -- Maximum stack size (KB).
    >  cpu -- Maximum CPU time (MIN).
    >  nproc -- Maximum number of processes.
    >  as -- Address space limit.
    >  maxlogins -- Maximum number of logins for this user or group.
    >  priority -- The priority to run user process with.
    >  
    >
    from bash manual:
    "The value of limit can be a number in the unit specified for the 
    resource, or the value unlimited"
    
    Having a fixed, absolute limit on: number, size, amount of resources 
    isn't very flexible - it's not dependent on current usage by other users.
    
    Now imagine there are 100 users of a system, all of them shouldn't be 
    trusted and belong more or less to the same hash bucket (so you can't 
    differentiate using per-group limits).
    Now, suppose that some of them use the system frequently, some of them 
    sporadically, some of them require as much resources as possible for 
    their work, some don't need that much. You can't determine beforehand 
    who will need what.
    
    If you can't specify those limits so that they are relative to amount of 
    resources available at the time of limit check, you're in problem - 
    either you leave limits too high and one user can bring the machine to 
    its knees, or you set the absolute limits and you start getting calls 
    from frustrated users whose software doesn't work because of those 
    limits being enforced.
    
    Best regards,
    
    -- 
        Olo
            GG#: 274614
            ICQ UIN: 19780575 
            http://olo.office.altkom.com.pl
    



    This archive was generated by hypermail 2b30 : Tue Jul 09 2002 - 11:16:39 PDT