Re: Patch related with Fork Bombing Atack

["Anand Jahagirdar" <anandjigar@gmail.com>]

Hello All

                I totally agree with all of you, but my idea behind
this patch is that administrator/root user must be able to know that
there is fork bombing attack on his machine and he should be able take
action agianst that particular user and kill all his processes.

can anybody please tell me how can we achive this??

Regards
Anand

On 6/1/07, Jiri Kosina <jikos@jikos.cz> wrote:
> On Fri, 1 Jun 2007, Anand Jahagirdar wrote:
>
> >     when they try to flood the syslog using fork bombing attack, their
> > messge will be printed only once in syslog and it will show how many
> > times it has repeated. due to this he will not able to flood the
> > syslog.and i am using only one single variable in my printk messge so it
> > is quite not possible to flood the syslog.
>
> Your argument is flawed - if the kernel provides more than one possibility
> to flood the syslogd, the is free to invoke the events interleaved. This
> trivially prevents syslogd from grouping identical reports together.
>
> --
> Jiri Kosina
>