Subject: Re: Fork bomb protection patch
To: der Mouse <mouse@Rodents.Montreal.QC.CA>
From: Dave Sainty <dave@dtsp.co.nz>
List: tech-kern
Date: 12/07/2002 00:17:07
der Mouse writes:

> > This variant:
> > [...wabbit code...]
> > Might be even more lively.
> 
> I once pondered how to build an `unkillable' wabbit.  Of course,
> ultimately, there is no such thing.  But I was trying to invent
> something that would require a sledgehammer like dropping to ddb to
> deal with.  I've never actually tried any of the ideas out, but it
> might be an amusing exercise on a scratch machine.  In particular,
> there has to be something to deal with the approach of hitting them
> with SIGSTOP to make them stop forking so you can kill them....

Heh, I was pondering this the other day after the realisation that
ptrace() could prevent SIGKILL from killing a process.

I've been thinking that a:

options NOPTRACE

... would be a useful option for hardening boxes...

Cheers,

Dave