Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1315312

Re: fs: sandboxed process brings host down

Show all headers | View raw

On Fri, Jan 22, 2016 at 10:38:40PM +0100, Dmitry Vyukov wrote:

> My 2GB VM dies at around just 10-th iteration, is it normal?
> Each iteration consumes several hundreds of megs of kernel memory. And
> there seems to be exponential slowdown at around 5-th iteration.
> I understand that there can be lots of forms of a local DoS. But there
> seems to be something pathological about this particular one. And it
> happens only with sandboxing that is meant to reduce DoS
> possibilities...

Sandboxing == giving attacker to do mount without being root.

As for exponential - sure, you double the amount of mounts on each step
(if not quadruple - I don't have your code in front of me right now,
but ISTR two mount --rbind in there).  More obvious form would be
for i in `seq 64`; do mkdir /tmp/$i; mount --rbind / /tmp/$i; done - there
the entire tree would be visible (and visibly exponential by the number of
iterations).

I doubt that the first iteration chews hundreds of megs, BTW.  If you
really get two mount --rbind per iteration, you would have about a million-fold
increase of the number of mounts after ten iterations, and having that chew
2Gb is quite plausible; in that case the first iteration would eat about 10K
or so...

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Re: fs: sandboxed process brings host down Al Viro <viro@ZenIV.linux.org.uk> - 2016-01-22 22:30 +0100
  Re: fs: sandboxed process brings host down Dmitry Vyukov <dvyukov@google.com> - 2016-01-22 22:40 +0100
    Re: fs: sandboxed process brings host down Al Viro <viro@ZenIV.linux.org.uk> - 2016-01-22 23:00 +0100
      Re: fs: sandboxed process brings host down Robert Święcki <robert@swiecki.net> - 2016-01-22 23:40 +0100
  Re: fs: sandboxed process brings host down Kees Cook <keescook@google.com> - 2016-01-22 22:50 +0100

csiph-web