search

samuraictf / gatekeeper

GATEKEEPER: Inline and on-target defense
119 stars 15 forks source link

Add rlimit options for RLIMIT_NPROC and RLIMIT_CPU #22

Closed bool101 closed 8 years ago

bool101 commented 9 years ago

RLIMIT_NPROC The maximum number of processes (or, more precisely on Linux, threads) that can be created for the real user ID of the calling process. Upon encountering this limit, fork(2) fails with the error EAGAIN. This limit is not enforced for processes that have either the CAP_SYS_ADMIN or the CAP_SYS_RESOURCE capability.

RLIMIT_CPU CPU time limit in seconds. When the process reaches the soft limit, it is sent a SIGXCPU signal. The default action for this signal is to terminate the process. However, the signal can be caught, and the handler can return control to the main program. If the process continues to consume CPU time, it will be sent SIGXCPU once per second until the hard limit is reached, at which time it is sent SIGKILL. (This latter point describes Linux behavior. Implementations vary in how they treat processes which continue to consume CPU time after reaching the soft limit. Portable applications that need to catch this signal should perform an orderly termination upon first receipt of SIGXCPU.)

zachriggle commented 9 years ago

See the examples in my branch for this. These are critical pieces of functionality to prevent forking and local DoS.