Bugtraq mailing list archives
Re: Linux kernels DoSable by file-max limit
From: <elv () openbeer it>
Date: 8 Jul 2002 23:06:01 -0000
In-Reply-To: <3D28AA94.8030105 () starzetz de>
Hi, the recently mentioned problem in BSD kernels
concerning the global
limit of open files seems to be present in the Linux-
kernel too. However
as mentioned in the advisory about the BSD specific
problem the Linux
kernel keeps some additional file slots reserved for the root user.
[...]
Greping the source code (2.4.18) reveals that the
limit is pretty low:
./include/linux/fs.h:#define NR_RESERVED_FILES 10 /*
reserved for root */
The problem is obviously the checking for superuser
privilege in the [*]
line since every user can usually run some setuid
binaries like passwd
or su.
hi all, the obvious solution to this problem is a proper use of setrlimit() (ulimit):
fddos output:
preforked child 0 errno 24 pid 896 got 29 files errno 24 pid 897 got 29 files errno 24 pid 898 got 29 files errno 24 pid 899 got 29 files errno 24 pid 900 got 29 files errno 24 pid 901 got 29 files errno 24 pid 902 got 29 files errno 24 pid 903 got 29 files errno 24 pid 904 got 29 files errno 24 pid 905 got 29 files errno 24 pid 906 got 29 files errno 24 pid 907 got 29 files
strace output:
[...] preforked child 0rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0 rt_sigaction(SIGCHLD, NULL, {SIG_DFL}, 8) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 nanosleep({1, 0}, {1, 0}) = 0 write(1, "\n\n\n", 3) = 3 fork() = 913 errno 24 pid 913 got 29 files [...] fork() = -1 EAGAIN (Resource temporarily unavailable) nanosleep({0, 100000000}, NULL) = 0 nanosleep({0, 100000000}, NULL) = 0 [...] elvinho ~ $ ulimit -Ha core file size (blocks, -c) 0 data seg size (kbytes, -d) 6144 file size (blocks, -f) 32768 max locked memory (kbytes, -l) unlimited max memory size (kbytes, -m) 1024 open files (-n) 32 pipe size (512 bytes, -p) 8 stack size (kbytes, -s) 4096 cpu time (seconds, -t) 300 max user processes (-u) 16 virtual memory (kbytes, -v) unlimited elvinho ~ $ you can set an ulimit mask in /etc/login.defs in this manner the problem is solved but the kernel bug still remains, so two little pieces of code: --- /usr/src/linux/fs/file_table.c Mon Sep 17 20:16:30 2001 +++ /usr/src/linux/fs/file_table.c Mon Jul 8 23:42:01 2002 @@ -51,9 +51,12 @@ return f; } /* - * Use a reserved one if we're the superuser + * Use one of the first 16 reserved fds if we have euid == 0 + * and one of the second 16 reserved fds if we're the superuser */ - if (files_stat.nr_free_files && !current-
euid)
+ if (files_stat.nr_free_files > (NR_RESERVED_FILES/2) && !current->euid) + goto used_one; + else if (files_stat.nr_free_files <= (NR_RESERVED_FILES/2) && !current->uid) goto used_one; /* * Allocate a new one if we're below the limit. --- /usr/src/linux/include/linux/fs.h Mon Jul 1 14:48:44 2002 +++ /usr/src/linux/include/linux/fs.h Tue Jul 9 00:07:06 2002 @@ -65,7 +65,7 @@ extern int leases_enable, dir_notify_enable, lease_break_time; #define NR_FILE 8192 /* this can well be larger on a larger system */ -#define NR_RESERVED_FILES 10 /* reserved for root */ +#define NR_RESERVED_FILES 32 /* first 16 for euid == 0 processes and second 16 only for root */ #define NR_SUPER 256 #define MAY_EXEC 1 we check if uid == 0 because suid bit cause the kernel to set the egid to the uid/gid of the binary owner: [...] /* Set-uid? */ if (mode & S_ISUID) bprm->e_uid = inode->i_uid; [...] /usr/src/linux/fs/exec.c line 631 of 1071 (58%) if someone can try to post these patches to the linux kernel ml it would be a good thing. cheers, elv
Current thread:
- Linux kernels DoSable by file-max limit Paul Starzetz (Jul 08)
- Re: Linux kernels DoSable by file-max limit Kurt Seifried (Jul 08)
- Re: Linux kernels DoSable by file-max limit Aleksander Adamowski (Jul 09)
- Re: Linux kernels DoSable by file-max limit Paul Starzetz (Jul 09)
- Re: Linux kernels DoSable by file-max limit Michal Zalewski (Jul 09)
- Re: Linux kernels DoSable by file-max limit Jim Breton (Jul 10)
- Re: Linux kernels DoSable by file-max limit Andrea Arcangeli (Jul 10)
- <Possible follow-ups>
- Re: Linux kernels DoSable by file-max limit elv (Jul 10)
- Re: Linux kernels DoSable by file-max limit Kurt Seifried (Jul 08)