From patchwork Thu Sep 10 20:21:02 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 11769071 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id B783F698 for ; Thu, 10 Sep 2020 20:21:33 +0000 (UTC) Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.kernel.org (Postfix) with SMTP id D0B4320829 for ; Thu, 10 Sep 2020 20:21:32 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="BclfH4h6" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org D0B4320829 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=chromium.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kernel-hardening-return-19858-patchwork-kernel-hardening=patchwork.kernel.org@lists.openwall.com Received: (qmail 19637 invoked by uid 550); 10 Sep 2020 20:21:30 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 19614 invoked from network); 10 Sep 2020 20:21:29 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=t7QYn1yhWQ40fqsjl2bkOVXNzJEardYI1LG85/i6U4Y=; b=BclfH4h6+3Bniz3hlYX1B8/uwcukDuLERmdv/too1YSZlXK9dBtB6T76hiHYKxbvf9 ygrdCHBb2d1zvH8fNVjO46IvyeFd1UQ1/ZyJKm4z7MgXVjH3rg/TxqlBaSg381uGWgSp a0ksHPHgB/X4oFDK2ba/ovfJCDRHiImWHRs4Y= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=t7QYn1yhWQ40fqsjl2bkOVXNzJEardYI1LG85/i6U4Y=; b=PqWSgiwq53/3Xwy9+1CSvNXikDDddVLZ8NDYOFu3hzsmHp+A0PY/aDkT/hGvAfsPV8 bYLlH5p/EVKl3366QG8l64a3IRDwYUSJ118/HM7EK/G15Z/F+7HHAsP+5Y2mlTtwIxcR h70VXcpRjYxiInBRpfsAj2dqVup0zbRaR+o9Tww2yyOORdfELWQbUtIM/9Nd82nMzlLY 6jSXM3IaRop5K/z41U8zgg2zSY9h1nwuvVGgWkc8eIVilPaGU5nDphKWDtnNQD41ECi2 vQGe25rPRKyc1eek0wxYHJS2tH3EseNMKWnfh1cNqGVhrdl7OF3H9Wp59N5IeyFU2cbr rJaQ== X-Gm-Message-State: AOAM533lzWqINq3HE7KU0k6BPoCS6EqpKSXYcv9+72Ci7VeRLeFrdHWN 9iHxlwwahqbCeJ4WVm3zTOv4qA== X-Google-Smtp-Source: ABdhPJx0DRsV2uk7XRhN5WyrdQ3GN+smsELZkM+SGtSpILq3ccN5AWUrZdo9DI6cB7SYJM/QqYly8g== X-Received: by 2002:a63:4418:: with SMTP id r24mr5838961pga.8.1599769277620; Thu, 10 Sep 2020 13:21:17 -0700 (PDT) From: Kees Cook To: kernel-hardening@lists.openwall.com Cc: Kees Cook , John Wood , Matthew Wilcox , Jonathan Corbet , Alexander Viro , Ingo Molnar , Peter Zijlstra , Juri Lelli , Vincent Guittot , Dietmar Eggemann , Steven Rostedt , Ben Segall , Mel Gorman , Luis Chamberlain , Iurii Zaikin , James Morris , "Serge E. Hallyn" , linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-security-module@vger.kernel.org Subject: [RFC PATCH 1/6] security/fbfam: Add a Kconfig to enable the fbfam feature Date: Thu, 10 Sep 2020 13:21:02 -0700 Message-Id: <20200910202107.3799376-2-keescook@chromium.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20200910202107.3799376-1-keescook@chromium.org> References: <20200910202107.3799376-1-keescook@chromium.org> MIME-Version: 1.0 From: John Wood Add a menu entry under "Security options" to enable the "Fork brute force attack mitigation" feature. Signed-off-by: John Wood --- security/Kconfig | 1 + security/fbfam/Kconfig | 10 ++++++++++ 2 files changed, 11 insertions(+) create mode 100644 security/fbfam/Kconfig diff --git a/security/Kconfig b/security/Kconfig index 7561f6f99f1d..00a90e25b8d5 100644 --- a/security/Kconfig +++ b/security/Kconfig @@ -290,6 +290,7 @@ config LSM If unsure, leave this as the default. source "security/Kconfig.hardening" +source "security/fbfam/Kconfig" endmenu diff --git a/security/fbfam/Kconfig b/security/fbfam/Kconfig new file mode 100644 index 000000000000..bbe7f6aad369 --- /dev/null +++ b/security/fbfam/Kconfig @@ -0,0 +1,10 @@ +# SPDX-License-Identifier: GPL-2.0 +config FBFAM + bool "Fork brute force attack mitigation" + default n + help + This is a user defense that detects any fork brute force attack + based on the application's crashing rate. When this measure is + triggered the fork system call is blocked. + + If you are unsure how to answer this question, answer N.