unprivileged user can freeze journald
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
systemd (Ubuntu) |
Fix Released
|
Medium
|
Martin Pitt |
Bug Description
On default installs of Ubuntu 15.10, both server and desktop, an unprivileged user can freeze journald using the attached program. (Journald is then eventually killed and restarted by systemd after a 1 min timeout is detected - but nothing prevent the unprivileged user to DOS in a loop if he feels so inclined.)
The reason is that journald uses inappropriate rules to decide if a file descriptor sent by a user is safe to read.
[ IMO that such a "feature" (passing messages to log to journald by fd to regular files) exists at all should be questioned anyway, given the kind of impacts it can have on various aspects of the whole system (e.g.: the fd is completely read in a malloc'ed area, up to 750 MB) ]
Fedora 23 misbehaves identically with its default conf: /bugzilla. redhat. com/show_ bug.cgi? id=1279251
https:/