reassign 599916 linux-2.6 severity 599916 wishlist thanks On Tue, Oct 12, 2010 at 01:24:11PM +0200, Holger Levsen wrote:
> as there are no process limits set, it's trivial for any user to use all
> resources:
> Just run this in bash: :() { :I:& };:
> (I obfuscated the exploit slightly. Mail me if you need to know how.)
> And voila, the system is gone. (=there are ressources left to be used.)
> I'm actually a bit lost how the default process limit is set, whether its
> 31500 or 16025 user processes, or unlimited. In any case, I succeeded in
> blowing up a squeeze system as nobody when the process limit was 16025.
> And I also succeeded on sid, and saw someone else kill his lenny vm.
pam_limits does not set policies for limits; these policies are set by the
kernel, and are merely shadowed by pam_limits for re-setting defaults. If
you think the default limits are wrong, talk to the kernel team; otherwise,
you can use /etc/security/limits.conf to set the limits to your taste -
that's what the config file is there for.
> I'm not sure if my reaction ("critical bug" as it breaks the ability to
> hand out access to unbtrusted users basically) is too much, since maybe
> this works as designed ("rather enable people to use the system by
> default, if you want it more restricted do so...") but I could also not
> find anything in NEWS or README.Debian...
I don't see why you would expect PAM to document the use of limits in either
place. This certainly isn't news.
--
Steve Langasek Give me a lever long enough and a Free OS
Debian Developer to set it on, and I can move the world.
Ubuntu Developer http://www.debian.org/
slanga...@ubuntu.com vor...@debian.org
signature.asc
Description: Digital signature
