Re: insecure scheduler in OpenBSD 4.7

Previous thread: OpenBSD & Xen Server & Watchdog Timeout & PCI Passthrough by Keith on Monday, October 11, 2010 - 11:11 am. (1 message)

Next thread: Today we launch The Dabber video player for free by The Dabber Player on Monday, October 11, 2010 - 4:29 pm. (1 message)
From: Dmitry-T
Date: Monday, October 11, 2010 - 1:41 pm

I'm install OpenBSD 4.7 (dmesg attached)

uname -a
OpenBSD d1.my.domain 4.7 GENERIC#112 amd64

Run as root:
dd if=/dev/wd0c of=/dev/null bs=1m &
dd if=/dev/wd0c of=/dev/null bs=1m &
dd if=/dev/wd0c of=/dev/null bs=1m &

top

load averages:  3.12,  2.50,  1.49    16:54:08
37 processes:  36 idle, 1 on processor
CPU states:  0.1% user,  0.0% nice,  7.3% system,  3.6% interrupt, 89.1% idle
Memory: Real: 35M/339M act/tot  Free: 2393M  Swap: 0K/3071M used/tot

  PID USERNAME PRI NICE  SIZE   RES STATE     WAIT      TIME    CPU COMMAND
  754 root     -14    0 2232K 1228K sleep     inode     0:24  6.10% dd
25914 root      -5    0 2216K 1224K sleep     getblk    0:24  6.05% dd
21919 root     -14    0 2204K 1224K sleep     inode     2:08  5.96% dd

iostat wd0 1

      tty            wd0             cpu
 tin tout  KB/t t/s MB/s  us ni sy in id
   0    0  2.00 5141 10.04   0  0 23 13 64
   0    0  2.00 5021 9.81   0  0 16 10 74
   0  299  2.00 5206 10.17   0  0 21  8 71
   0    0  2.00 5066 9.90   0  0 15  8 77


Run as _normal user_:
dd if=/dev/urandom of=/dev/null

Try to recover ballance:
renice 20 -p 30996
renice -20 -p 21919 25914 754

top

load averages:  3.53,  3.55,  3.00    17:12:19
38 processes:  1 running, 36 idle, 1 on processor
CPU states:  0.0% user,  0.0% nice, 98.4% system,  1.6% interrupt,  0.0% idle
Memory: Real: 36M/339M act/tot  Free: 2394M  Swap: 0K/3071M used/tot

  PID USERNAME PRI NICE  SIZE   RES STATE     WAIT      TIME    CPU COMMAND
30996 teldi    104   20  216K  200K run       -         4:48 97.95% dd
21919 root     -14  -20 2204K 1224K sleep     inode     2:15  0.15% dd
25914 root     -14  -20 2216K 1224K sleep     inode     0:31  0.00% dd
  754 root      -5  -20 2232K 1228K sleep     getblk    0:31  0.00% dd

iostat wd0 1

      tty            wd0             cpu
 tin tout  KB/t t/s MB/s  us ni sy in id
   1  283  2.00 375 0.73   0  0 99  1  0
   0    0  2.00 374 0.73   0  0100  0  0
   0    0  2.00 375 0.73   0  0 98  2  0
   0    ...
From: Ted Unangst
Date: Monday, October 11, 2010 - 1:54 pm

echo yes | rmuser `ps ua -p \`pgrep dd\` | tail -1 | awk '{print $1}'`

From: Dmitry-T
Date: Monday, October 11, 2010 - 2:12 pm

This is naive :)
dd only example, you need to search users who load CPU.
And with voracious programs you also have to be careful.

-- 
Dmitry Telegin

From: Firas Kraiem
Date: Monday, October 11, 2010 - 2:22 pm

You're the naive one. If a user can DOS the system just by doing dd, it
means the system's policy is very weak, so the user can probably just as
well throw a forkbomb.

From: Dmitry-T
Date: Monday, October 11, 2010 - 3:09 pm

dd only example.
Look around: Linux, Mac OS X, FreeBSD... why defend a design error?


-- 
Dmitry Telegin

From: Gilles Chehade
Date: Monday, October 11, 2010 - 3:23 pm

Why don't you use Linux or Mac OS X or FreeBSD then ?

I hear Ubuntu has a new release, you really *really* want to try it
out as it has every single feature you can think off and probably a
lot more. I can only encourage you to go download it and never turn 
back... sshhh... don't say a word, just leave, we'll be ok ;-)

Gilles

-- 
Gilles Chehade

From: Дмитрий Царьков
Date: Tuesday, October 12, 2010 - 6:14 am

I just wanted to wonder, what are You doing here if You think that
OpenBSD developpers are incompetent and tend to protect any of their
deQisions regardless its quality?

If this is the case, then OpenBSD must be fundamentally insecure and
thus entirely missing its own saling point, so it must be of no
interest to You.

Otherwise, may be it would a better idea to understand a reason for
such a design before any argument occures?

--
Dmitrij D. Czarkoff

From: J Sisson
Date: Tuesday, October 12, 2010 - 7:39 am

Because Linux/Mac OS X/FreeBSD are the yardsticks that
all Unix systems must measure up to, right?

From: Martin Schröder
Date: Monday, October 11, 2010 - 1:59 pm

man ulimit

Best
   Martin

From: Dmitry-T
Date: Monday, October 11, 2010 - 2:43 pm

I'm search "hosting" in FAQ and find only 

It is not a panacea.
Web servers have limit for the maximum amount of cpu time, but 
php script can rerun itself.


-- 
Dmitry Telegin

From: Brad Tilley
Date: Monday, October 11, 2010 - 3:49 pm

From: Fred Crowson
Date: Monday, October 11, 2010 - 4:11 pm

Isn't l33t speak for "hey man your really pushing me up and over the limit?"

From: Henning Brauer
Date: Monday, October 11, 2010 - 2:22 pm

you have repeatedly demonstrated that you plain don't understand
a) UNIX
b) the numbers you see
c) the fact that a computer has more ressources than a freakin' CPU
d) much more that I am not willing to work out ofr you

and I for one and sick of tired of you completely unfounded whining
and will not waste more time on it.

and fwiw, i run shitloads of OpenBSD servers for hosting purposes.

-- 
Henning Brauer, hb@bsws.de, henning@openbsd.org
BS Web Services, http://bsws.de
Full-Service ISP - Secure Hosting, Mail and DNS Services
Dedicated Servers, Rootservers, Application Hosting

From: Tomas Bodzar
Date: Monday, October 11, 2010 - 9:04 pm

First of all people don't use NVIDIA crap for hosting platform (or any
other use). Or at least they try to avoid it as much as possible. As
you can see in your dmesg you have quite a lot of unsupported parts of
HW (or badly working/set).

It's fault of other OSs' that NVIDIA plays game about "available open
source drivers" and that they want to play it. Couple of NVIDIA
developers said during interviews that they don't care about open
source systems, they develop only for payed systems. And not only SW
part is crap in their case ;-)

Anyway bigger problem is on your side as you don't want to learn or
see differences in OpenBSD design and why is that and more
specifically why it's better. You're looking at it from the point of
view of Linux and other systems because you think that there is
everything fine in them and that it's secure.

FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUS



--
bIf youbre good at something, never do it for free.bB bThe Joker

From: Jean-Francois
Date: Tuesday, October 12, 2010 - 4:07 am

I've been convinced not to biy NVidia anymore.


From: Alexandre Ratchov
Date: Tuesday, October 12, 2010 - 4:57 am

^^^^^

If you run any cpu bound process with priority -20, you will give all
the cpu to that process, without giving any chance to other processes
to run, so your box will hang until it terminates. This requires root

Yeah, this is an attack root can do by renicing a cpu bound process,
but ``rm -rf /'' is much easier, isn't it?

-- Alexandre

From: Oliver Peter
Date: Tuesday, October 12, 2010 - 5:35 am

On Tue, 12 Oct 2010 13:57:20 +0200

"If you aim the gun at your foot and pull the trigger, it's
UNIX's job to ensure reliable delivery of the bullet to
where you aimed the gun (in this case, Mr. Foot)."
        -- Terry Lambert

From: Jeremy O'Brien
Date: Thursday, December 16, 2010 - 5:56 pm

I was curious why no one brought this up earlier. A normal user _can't_
nice processes to anything below 0. Therefore this point is moot.

From: Kevin Chadwick
Date: Friday, December 17, 2010 - 3:39 am

On Thu, 16 Dec 2010 19:56:50 -0500

It's definately in there and in a couple of places I think, among the
chaff, It turned into two threads. I couldn't recreate the
problem originally stated either. There was some differences to the
Linux scheduler and disk io brought up that was slightly debateable but
generally favoured the linux scheduler atleast when taken by itself,
AFAIK.

From: Jordi Espasa Clofent
Date: Tuesday, October 12, 2010 - 7:59 am

OpenBSD is a great solution as a web-hosting platform; no more to say: 
it is. I've been involved for more than 3 years in web-hosting industry 
and I know the facts and what are you talking about

What happened here is simple:

* you don't understand how UNIX work
* you don't read a lot of good responses to your questions
* the problem is not the system (OpenBSD in thase), but the system 
administrator. You, of course. You're not a skilled system adminitrador.

Read and understand. Take you time. Be humble. Be patient. Read again. 
Understand really. Read again and again and again.

A good point to start is provided by OpenBSD website:
http://openbsd.org/books.html

As Henning has said: no more to comment. It's up to you now, I won't 
waste 1 second more of my precious time.

-- 
I will face my fear. I will permit it to pass over me and through me. 
And when it has gone past I will turn the inner eye to see its path. 
Where the fear has gone there will be nothing. Only I will remain.

From: Christiano F. Haesbaert
Date: Tuesday, October 12, 2010 - 8:51 am

Russian rappers... go figure

Previous thread: OpenBSD & Xen Server & Watchdog Timeout & PCI Passthrough by Keith on Monday, October 11, 2010 - 11:11 am. (1 message)

Next thread: Today we launch The Dabber video player for free by The Dabber Player on Monday, October 11, 2010 - 4:29 pm. (1 message)