RE: possible gnome-terminal/vte DoS?

Shouldn't there be some kind of "memory quota" for non-root users?


> -----Original Message-----
> From: Mike A. Harris [mailto:[email protected]]
> Sent: Wed, September 18, 2002 8:37 PM
> To: [email protected]
> Subject: Re: possible gnome-terminal/vte DoS?
> 
> 
> On 18 Sep 2002, Havoc Pennington wrote:
> 
> >Date: 18 Sep 2002 10:04:29 -0400
> >From: Havoc Pennington <[email protected]>
> >To: [email protected]
> >Content-Type: text/plain; charset=us-ascii
> >List-Id: Discussion of the Red Hat Linux 'Limbo' beta
> >    <limbo-list.redhat.com>
> >Subject: Re: possible gnome-terminal/vte DoS?
> >
> >
> >"Barry K. Nathan" <[email protected]> writes: 
> >> Imagine an attacker with physical access to the keyboard 
> and mouse but
> >> not to the computer itself (the computer itself is 
> physically secured).
> >> The computer allows one person (at a time) to use it in 
> person and also
> >> allows other users to use it remotely via SSH.
> >> 
> >> Assume that Alice and Bob are connected to this system 
> remotely and that
> >> Charlie is using it in person. Charlie knows that Alice and Bob are
> >> logged in (maybe he ran the "who" command, maybe he just 
> finished a cell
> >> phone conversation with one of them). Charlie, for some 
> reason, wants to
> >> annoy Alice and Bob. (Or, even if no remote access is 
> possible, maybe he
> >> just wants to take one computer out of commission 
> temporarily and annoy
> >> everyone else in the lab.) So he takes his open 
> gnome-terminal, sets the
> >> font size to 12000 and ka-boom.
> >> 
> >
> >But a plain malloc bomb or fork bomb anyone can write would do the
> >same - if you can run programs on a computer, you can always send its
> >load through the roof.
> >
> >Anyway, will fix. Thanks for the bug report.
> 
> As an example to illustrate....
> 
> Save all important data open on your machine, and at a bash 
> prompt type:
> 
> :(){ :|:&};:
> 
> 
> -- 
> Mike A. Harris		ftp://people.redhat.com/mharris
> OS Systems Engineer
> XFree86 maintainer
> Red Hat Inc.
> 
> 
> 
> _______________________________________________
> Limbo-list mailing list
> [email protected]
> https://listman.redhat.com/mailman/listinfo/limbo-list
>