[1392] in linux-security and linux-alert archive
[linux-security] Re: dos-attack on inetd.
daemon@ATHENA.MIT.EDU (Wietse Venema)
Fri Jan 17 08:47:58 1997
From: wietse@porcupine.org (Wietse Venema)
To: linux-security@redhat.com
Date: Thu, 16 Jan 1997 15:19:48 -0500 (EST)
In-Reply-To: <19970115232347.10045.qmail@taz.nceye.net> from "Bryan Reece" at Jan 15, 97 11:23:47 pm
Resent-From: linux-security@redhat.com
Reply-To: linux-security@redhat.com
> [mod: Yes, but actually whenever inetd recieves a sigpipe it should
> NOT exit. I'd say moving the "signal(SIGPIPE, SIG_IGN);" over to the
> initialization, and leaving out the "put it back code" would be best --REW]
This would disable SIGPIPE signals in all inetd child processes.
If you want to inetd to implement policies for signals, core dumps and
whatnot, the policy had better be configurable per service.
In the absence of such a configuration mechanism, it seems better to
restore signal handling before inetd forks/execs an external server.
[mod: I didn't know that these got carried over fork/exec. My mistake -- REW]
Wietse
