| 1 |
Hi, |
| 2 |
|
| 3 |
Logrotate has a very strange behavior on my grsec box : |
| 4 |
after reading the config files, there is a big lockup, logrotate does not |
| 5 |
start rotating the logs, and use 100% CPU. Here is the verbose output : |
| 6 |
|
| 7 |
=====================8<===================== |
| 8 |
# logrotate /etc/logrotate.conf -v |
| 9 |
reading config file /etc/logrotate.conf |
| 10 |
including /etc/logrotate.d |
| 11 |
reading config file acpid |
| 12 |
reading config info for /var/log/acpid |
| 13 |
reading config file apache2 |
| 14 |
reading config info for /var/log/apache2/*log |
| 15 |
reading config file fail2ban |
| 16 |
reading config info for /var/log/fail2ban.log |
| 17 |
reading config file samba |
| 18 |
reading config info for /var/log/samba/log |
| 19 |
reading config file syslog-ng |
| 20 |
reading config info |
| 21 |
for /var/log/syslog /var/log/auth.log /var/log/mail.err /var/log/cron.log |
| 22 |
/var/log/mail.log /var/log/messages /var/log/user.log /var/log/daemon.log |
| 23 |
/var/log/kern.log /var/log/imapd.log /var/log/grsec.log /var/log/iptables.log |
| 24 |
/var/log/rsync.log |
| 25 |
reading config info for /var/log/wtmp |
| 26 |
<HERE IS THE LOCKUP> |
| 27 |
=====================>8===================== |
| 28 |
|
| 29 |
The same logrotate config works well on my desktop (non hardened) box. |
| 30 |
Strace output of logrotate execution sounds quite strange to me. Seems |
| 31 |
logrotate loops for half an hour with this message : |
| 32 |
|
| 33 |
=====================8<===================== |
| 34 |
mremap(0x4ae6d000, 557056, 557056, MREMAP_MAYMOVE) = 0x4ae6d000 |
| 35 |
stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=1082, ...}) = 0 |
| 36 |
stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=1082, ...}) = 0 |
| 37 |
mremap(0x4ae6d000, 557056, 557056, MREMAP_MAYMOVE) = 0x4ae6d000 |
| 38 |
stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=1082, ...}) = 0 |
| 39 |
stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=1082, ...}) = 0 |
| 40 |
mremap(0x4ae6d000, 557056, 557056, MREMAP_MAYMOVE) = 0x4ae6d000 |
| 41 |
stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=1082, ...}) = 0 |
| 42 |
stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=1082, ...}) = 0 |
| 43 |
mremap(0x4ae6d000, 557056, 557056, MREMAP_MAYMOVE) = 0x4ae6d000 |
| 44 |
stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=1082, ...}) = 0 |
| 45 |
stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=1082, ...}) = 0 |
| 46 |
mremap(0x4ae6d000, 557056, 557056, MREMAP_MAYMOVE) = 0x4ae6d000 |
| 47 |
stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=1082, ...}) = 0 |
| 48 |
stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=1082, ...}) = 0 |
| 49 |
mremap(0x4ae6d000, 557056, 557056, MREMAP_MAYMOVE) = 0x4ae6d000 |
| 50 |
=====================>8===================== |
| 51 |
|
| 52 |
Do you have any idea of what could cause this strange behavior ? |
| 53 |
|
| 54 |
Some config infos : |
| 55 |
- using a vanilla 2.6.14.6 with grsec patch 2.1.8 |
| 56 |
- rbac is disabled for those tests |
| 57 |
- logrotate is 3.7.1-r2 |
| 58 |
- hardened profile hardened/x86/2.6 full ~x86 |
| 59 |
- CFLAGS : -march=pentium4 -O2 -mtune=pentium4 -fomit-frame-pointer -pipe |
| 60 |
|
| 61 |
Regards, |
| 62 |
-- |
| 63 |
Guillaume Castagnino |
| 64 |
guilc@×××××××.net / casta@×××××.info |
| 65 |
GnuPG/PGP key : |
| 66 |
http://wwwkeys.pgp.net:11371/pks/lookup?op=vindex&search=0x8AF468AF |
| 67 |
Fingerprint : CD52 FE40 9592 BA1E E89D 5FB6 820E 4742 8AF4 68AF |
Archives