Patch related with Fork Bombing Atack

["Anand Jahagirdar" <anandjigar@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 1080 bytes --]

Dear Sir
            I am forwarding one patch related with fork bombing attack.

 actually ulimit helps to prevent fork bombing attack.

        1)    when i searched for the code which actually prevents
fork bombing attack in kernel/fork.c file, it took lot of time to
search for the code.

        2)  when we set the ulimit in /etc/security/limits.conf file
for guest account and then try fork bombing attack using guest
account. ulimit prevents fork bombing attack but administrator/root
user wont come to know that somebody is trying fork bombing attack on
his machine.

Due to this two reasons i tried to create a patch which will solve
above mentioned problems.

1) Commented Code in my patch will Definitely Help Developer to get
the prevention code for Fork bombing Attack very easily.

2) Printk message in my patch will definitely help Administrator/Root
User to detect which particular user is trying fork bombing attack on
his machine by looking at /var/log/messages or dmesg . he can take
action against that particular user and kill his processes.

Regards,
Anand

[-- Attachment #2: fork.patch~ --]
[-- Type: application/octet-stream, Size: 937 bytes --]

Index: root/Desktop/a1/linux-2.6.17.tar.bz2_FILES/linux-2.6.17/kernel/fork.c
===================================================================
--- root.orig/Desktop/a1/linux-2.6.17.tar.bz2_FILES/linux-2.6.17/kernel/fork.c	2007-05-31 16:46:22.000000000 +0530
+++ root/Desktop/a1/linux-2.6.17.tar.bz2_FILES/linux-2.6.17/kernel/fork.c	2007-05-31 16:53:02.000000000 +0530
@@ -956,13 +956,18 @@
 		goto fork_out;
 
 	retval = -EAGAIN;
-	
+
+	/*
+	 * Following code does not allow Non Root User to cross its process 
+	 * limit and it prevents Fork Bombing Attack.
+	 */	
 	if (atomic_read(&p->user->processes) >=
 			p->signal->rlim[RLIMIT_NPROC].rlim_cur) {
 		if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
-				p->user != &root_user) 
+				p->user != &root_user) {
+			printk(KERN_CRIT"User with uid %d is crossing its Process limit\n",p->user->uid);
 			goto bad_fork_free;
-		
+		}
 	}
 
 	atomic_inc(&p->user->__count);