Re: closefd: closes a file of any process

[Werner Almesberger]

Tigran Aivazian wrote:
> but the applications are so nasty that they come in parent-child
> relationship and monitor each others death and fork() quickly enough to keep
> the filesystem busy however fast you shoot them with fuser -k.

And they also make sure they're not in the same process group, I guess ?
(kill -pgrp is atomic.)

Seems that you would be better off with a way to block clone(2). After
all, they could also monitor their ability to access files, etc. Even
this may leave holes. So in the end you're probably looking for a means
to kill by uid (after revoking the offender's account), or by a list of
uids if you have conspiring malicious users.

Actually, didn't somebody recently post something that allows quite
fine-grained control over what system calls a process is allowed to
invoke ? This may be appropriate if you have a machine full of
potentially hostile users.

- Werner

-- 
  _________________________________________________________________________
 / Werner Almesberger, ICA, EPFL, CH       [e-mail] /
/_IN_N_032__Tel_+41_21_693_6621__Fax_+41_21_693_6610_____________________/