Re: siege failing and so on

-                                                 [email protected]
---------------------------------------------------------------------

On Sunday 12 October 2003 19:41, [email protected] wrote:
> -                                                 [email protected]
> ---------------------------------------------------------------------
>
> On Sun, Oct 12, 2003 at 07:22:48PM +0200, Asbj?rn Sannes wrote:
>
> <snip>
>
> > I've been thinking about this for a while, on a production webserver, can
> > we not stop people from attaching stuff to processes in the OS?
>
> hmm, perhaps we could do a little trick. Let an watch process ptrace
> the processors. This would prevent the attacker from ptracing it and will
> ensure that he cannot put its own code into the webserver process.
> How many resources will this consume ?

Linux has CAP_PTRACE to do this, right?

> Another problem is preventing the processor from hurting itself
> (exploiting mod_php, etc). Is it possible to prevent an process from
> overwriting its own code ?

This isn't really the job of apache? (stopping modules from doing things wrong 
is taking it a bit far, what if that is the purpose of the module .. and so 
on :> ). There are patches for the kernel (for linux) that does these things 
tough. 

-- 
--
Asbjorn Sannes
[email protected]
www.sannes.org