On Fri, Jun 01 2007, Daniel Hazelton wrote: > On Friday 01 June 2007 02:48:59 Anand Jahagirdar wrote: > > On 5/31/07, Jens Axboe <[EMAIL PROTECTED]> wrote: > > > On Thu, May 31 2007, Anand Jahagirdar wrote: > > > > 2) Printk message in my patch will definitely help Administrator/Root > > > > User to detect which particular user is trying fork bombing attack on > > > > his machine by looking at /var/log/messages or dmesg . he can take > > > > action against that particular user and kill his processes. > > > > > > You just opened a DoS possibility for any user, they can now flood the > > > syslog instead. > > > > Jens Axboe > > > > when they try to flood the syslog using fork bombing attack, > > their messge will be printed only once in syslog and it will show how > > many times it has repeated. due to this he will not able to flood the > > syslog.and i am using only one single variable in my printk messge so > > it is quite not possible to flood the syslog. > > > > am i missing something?? > > > > anand > > Most definately. Each printk() call outputs to syslog - which means > that every time your code outputs its message there is another line in > the logs. It then becomes possible to use that to flood the syslog.
I think Anand is assuming that because syslog may coalesce identical messages into "repeated foo times" in the messages file, that it's not a dos. That is of course wrong. -- Jens Axboe - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
