Re: [gentoo-hardened] RSBAC sources log flooding

[kang]

Darknight wrote:

> On both my test machines I have lots of these messages in kern.log:
>
> Oct 10 18:59:08 silicon rsbac_adf_request(): request ACCEPT, pid
> 12797, ppid 12761, prog_name mysqld, prog_file /usr/sbin/my
> sqld, uid 60, audit_uid 60, target_type NETOBJ, tid dc2d4780 UNIX
> STREAM /var/run/mysqld/mysqld.sock, attr none, value none,
>  result NOT_GRANTED (Softmode) by RC
>
> I really mean lots, I think I have followed scrupolously the guide,
> but I may be wrong. Everything seems to work but at the same time I
> get flooded by these messages. This gets so bad to the point where the
> flood fills memory and causes disconnections and lots of lag during an
> scp of many small files.
>
> Thanks in advance :)

Yep, I suggest you to turn off logging via syslog and use rmsg. I wrote
a howto for syslog-ng here:
http://rsbac.org/documentation/administration_examples/syslog-ng

In short simply have CONFIG_RSBAC_RMSG_NOSYSLOG compiled in kernel and
boot with the kernel flag  rsbac_nosyslog
All messages will now be only logged to /proc/rsbac-info/rmsg, which
works alike /proc/kmsg. This means you can use your favorite logger to
log and parse the messages.

A word of warning: syslog-ng will generate more messages because some
things it does get refused. If you dont fix thoses, you will fill your
log by watching it!
You may use rklogd which should generate no msg if you prefer.

Once you did that, logging should become less of a problem, it will be
rate limited anyway.

Now let's take care of fixing your messsage:
Oct 10 18:59:08 silicon rsbac_adf_request(): request ACCEPT, pid 12797,
ppid 12761, prog_name mysqld, prog_file /usr/sbin/my
sqld, uid 60, audit_uid 60, target_type NETOBJ, tid dc2d4780 UNIX STREAM
/var/run/mysqld/mysqld.sock, attr none, value none,
 result NOT_GRANTED (Softmode) by RC

This means you are running in non-enforcing mode (softmode, in RSBAC)
and that the RC module does not allow program mysqld -/usr/sbin/mysqld)
of uid 60 to use the request ACCEPT on the unix socket
/var/run/mysqld/mysqld.sock. It means denied requests WONT be denied.
Just logged.

If this sounds like giberring, please look at the target and requests
table here:
http://rsbac.org/documentation/targets_and_requests

Your target NETOBJ (UNIX STREAM) has a request for ACCEPT.

Please note that in RSBAC 1.3.0 (current stable is 1.2.5) Unix sockets
will be a filesystem target instead of a netobj. This is because it is
easier and more logical to administrate unix sockets.
However, you will have to deal with netobj until then :)

You will find an example how to manage netobj/nettemplates here:
http://rsbac.org/documentation/administration_examples/network_access_control

Simply allow the accept request (and any other necessary, thoses are in
logs)
You can use rsbac_menu to assign RC types, and manage thoses templates
"more easily".

Feel free to ask on the various IRC channel if any more help is needed
(freenode, #rsbac, #gentoo-hardened)

kang
-- 
gentoo-hardened@g.o mailing list