FreeBSD Security Advisory FreeBSD-SA-16:15.sysarch [REVISED]

[Dag-Erling Smørgrav]

CeDeROM <cederom at tlen.pl> writes:
> You have this idea to remove local denial of service advisories.

No.  With very few (imho unfortunate) exceptions, we have *never* issued
advisories for local DoS exploits.  So we're not taking anything away
from you.

> My idea is to move them into benchmarks/recommendations such as CIS,

The CIS benchmarks are not lists of vulnerabilities.  They are lists of
best practices for configuring a machine, and shell scripts that tell
you whether a machine is configured correctly according to the
benchmark.

The only way to prevent local denial of service attacks is to not have
any users.  A four-byte shell script will send the load through the
roof.  A seven- or ten-byte script will render the machine unusable, and
you won't even be able to log in to kill it.  These are not bugs,
they're fundamental features of the operating system, and you can't plug
them without making the system useless for its intended purpose.

DES
-- 
Dag-Erling Smørgrav - des at des.no