I need to protect against a fork bomb, where everyone is one uid.

ScarletCarson · 2012-07-29 04:05:09

I have designed a system where students have to write a program and run an suid program which I have created, which checks certain things about it (depending on level).
The users will be dropped to a shell owned by the next level when my suid program thinks the students output is ok (password to each level is in a file in that levels home dir).

However...

One student managed to start a fork bomb on one of the levels, and I had not thought about protecting against. Which led to the entire system being locked up overnight until I came back and restarted it.

My problem is I don't want to restrict processes based on user, because if another student bombs a level then that entire level drops out of action.
I do have the students logging into the system through ssh, so my question is:

Can I limit the number of processes per ssh connection, or something similar?

PS
The system is not an arch system, but I use arch on all of my home systems.

Blµb · 2012-07-29 09:22:29

If it's a multi-core system you can at least restrict them to a set of CPUs to make sure there's at least a way to login without having to reboot.
(You'd do that by putting whatever they log-in with into a new cpuset control group and setting its cpuset.cpus)

Maybe there's even a way to limit the amount of processes in a control group, I don't know.

ScarletCarson · 2012-07-29 21:41:31

Good Idea. I'll definitely put that in.

debdj · 2012-07-30 10:23:16

maybe limiting some attributes from this file will help:
/etc/security/limits.conf

Arch Linux

#1 2012-07-29 04:05:09

I need to protect against a fork bomb, where everyone is one uid.

#2 2012-07-29 09:22:29

Re: I need to protect against a fork bomb, where everyone is one uid.

#3 2012-07-29 21:41:31

Re: I need to protect against a fork bomb, where everyone is one uid.

#4 2012-07-30 10:23:16

Re: I need to protect against a fork bomb, where everyone is one uid.

Board footer