Your message dated Wed, 21 Jan 2015 15:22:03 +0000
with message-id <e1ydx6z-0005wn...@franck.debian.org>
and subject line Bug#775067: fixed in systemd 218-4
has caused the Debian Bug report #775067,
regarding systemd: journald doesn't forward messages to syslog w/o
CAP_SYS_ADMIN (LXC)
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
775067: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775067
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: systemd
Version: 215-8
Severity: grave
Tags: upstream patch
Justification: causes non-serious data loss
Dear Maintainer,
when using LXC containers without CAP_SYS_ADMIN, journald fails to
forward any messages to syslog by default. Since the journal is not
persistent by default, no logs are stored at all, hence the
classification as 'data loss'. Also, this is a regression from Wheezy,
where a container without CAP_SYS_ADMIN and syslog did indeed store
persistent logs in /var/log/{syslog,messages,...}.
Note that there is NO other problem with systemd related to missing
CAP_SYS_ADMIN in a container (that I have found so far), provided all
required (pseudo-) file systems are mounted beforehand (which can be
done by configuration with Jessie's LXC version). I do know that
upstream claims that CAP_SYS_ADMIN-less containers are currently not
really supported, but they do intend to work towards that, and, from
what I can tell, apart from this journald problem, I have found no
issue whatsoever with a missing CAP_SYS_ADMIN (it actually works even
better than under sysvinit because it doesn't try to do some stuff
it's not supposed to do in containers that cause error messages with
sysvinit) - and since these kinds of containers were working in
Wheezy with its default init, I think this should be supported in
Jessie, too, especially if the fix is really easy, see below.
This bug is independent of the syslog implementation used, because no
syslog implementation in Jessie supports reading directly from the
journal, as far as I can tell (syslog-ng is too old, rsyslog is built
without imjournal support), so all rely on ForwardToSyslog=yes.
The reason why this problem occurs is that journald tries to fake
SCM_CREDENTIALS before sending a packet to the syslog daemon. With
CAP_SETUID and CAP_SETGID, faking uid/gid is not a problem, but to fake
the pid in struct ucred, one needs CAP_SYS_ADMIN (according to current
kernel source).
Also note that without activating debugging in journald, this problem
can not be diagnosed easily (it took me a while with strace to find the
problem).
Note, however, two things:
- journald does (and can) not guarantee that it can fake the pid,
because the process could have already exited. If you look at the
source, in case ESRCH is returned, it just fakes uid/gid and uses
its own pid
- both rsyslog and syslog-ng (haven't tried anything else yet) don't
rely on SCM_CREDENTIAL's pid anyway in their default configuration,
so at least in the default configuration there's no reason to fail
in that case.
I have created (and tested) an absolutely trivial patch that fixes this
by not only checking for ESRCH but also EPERM and then avoid faking the
pid.
I have tested this with both rsyslog and syslog-ng and it works and
both store (the same ;-)) persistent log messages in
/var/log/{messages,syslog,...}.
-- System Information:
Debian Release: 8.0
APT prefers testing
APT policy: (990, 'testing')
Architecture: amd64 (x86_64)
Kernel: Linux 3.16.0-4-amd64 (SMP w/1 CPU core)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
Versions of packages systemd depends on:
ii acl 2.2.52-2
ii adduser 3.113+nmu3
ii initscripts 2.88dsf-58
ii libacl1 2.2.52-2
ii libaudit1 1:2.4-1+b1
ii libblkid1 2.25.2-4
ii libc6 2.19-13
ii libcap2 1:2.24-6
ii libcap2-bin 1:2.24-6
ii libcryptsetup4 2:1.6.6-4
ii libgcrypt20 1.6.2-4+b1
ii libkmod2 18-3
ii liblzma5 5.1.1alpha+20120614-2+b3
ii libpam0g 1.1.8-3.1
ii libselinux1 2.3-2
ii libsystemd0 215-8
ii mount 2.25.2-4
ii sysv-rc 2.88dsf-58
ii udev 215-8
ii util-linux 2.25.2-4
Versions of packages systemd recommends:
ii dbus 1.8.12-3
ii libpam-systemd 215-8
Versions of packages systemd suggests:
pn systemd-ui <none>
-- no debconf information
Description: Make journald syslog fwd'ing work w/o CAP_SYS_ADMIN
In case CAP_SYS_ADMIN is missing, one cannot fake pid in struct ucred
(uid/gid are find if CAP_SETUID/CAP_SETGID are present), which is the
case in some container setups.
.
This patch makes sure that journald will try again to forward the
messages to syslog, without faking the SCM_CREDENTIALS pid this time
(which isn't guaranteed anyway, since it also does the same thing if
the process has already exited).
.
With this patch, journald will no longer silently discard messages
that are supposed to be sent to syslog in these situations.
Author: Christian Seiler <christ...@iwakd.de>
---
This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
Index: systemd-215/src/journal/journald-syslog.c
===================================================================
--- systemd-215.orig/src/journal/journald-syslog.c
+++ systemd-215/src/journal/journald-syslog.c
@@ -85,12 +85,12 @@ static void forward_syslog_iovec(Server
return;
}
- if (ucred && errno == ESRCH) {
+ if (ucred && (errno == ESRCH || errno == EPERM)) {
struct ucred u;
/* Hmm, presumably the sender process vanished
- * by now, so let's fix it as good as we
- * can, and retry */
+ * by now, or we don't have CAP_SYS_AMDIN, so
+ * let's fix it as good as we can, and retry */
u = *ucred;
u.pid = getpid();
--- End Message ---
--- Begin Message ---
Source: systemd
Source-Version: 218-4
We believe that the bug you reported is fixed in the latest version of
systemd, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 775...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Martin Pitt <mp...@debian.org> (supplier of updated systemd package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Wed, 21 Jan 2015 15:57:50 +0100
Source: systemd
Binary: systemd systemd-sysv libpam-systemd libsystemd0 libsystemd-dev
libsystemd-login0 libsystemd-login-dev libsystemd-daemon0 libsystemd-daemon-dev
libsystemd-journal0 libsystemd-journal-dev libsystemd-id128-0
libsystemd-id128-dev udev libudev1 libudev-dev udev-udeb libudev1-udeb
libgudev-1.0-0 gir1.2-gudev-1.0 libgudev-1.0-dev python3-systemd systemd-dbg
Architecture: source amd64
Version: 218-4
Distribution: experimental
Urgency: medium
Maintainer: Debian systemd Maintainers
<pkg-systemd-maintain...@lists.alioth.debian.org>
Changed-By: Martin Pitt <mp...@debian.org>
Description:
gir1.2-gudev-1.0 - libgudev-1.0 introspection data
libgudev-1.0-0 - GObject-based wrapper library for libudev
libgudev-1.0-dev - libgudev-1.0 development files
libpam-systemd - system and service manager - PAM module
libsystemd-daemon-dev - systemd utility library (transitional package)
libsystemd-daemon0 - systemd utility library (deprecated)
libsystemd-dev - systemd utility library - development files
libsystemd-id128-0 - systemd 128 bit ID utility library (deprecated)
libsystemd-id128-dev - systemd 128 bit ID utility library (transitional
package)
libsystemd-journal-dev - systemd journal utility library (transitional package)
libsystemd-journal0 - systemd journal utility library (deprecated)
libsystemd-login-dev - systemd login utility library (transitional package)
libsystemd-login0 - systemd login utility library (deprecated)
libsystemd0 - systemd utility library
libudev-dev - libudev development files
libudev1 - libudev shared library
libudev1-udeb - libudev shared library (udeb)
python3-systemd - Python 3 bindings for systemd
systemd - system and service manager
systemd-dbg - system and service manager (debug symbols)
systemd-sysv - system and service manager - SysV links
udev - /dev/ and hotplug management daemon
udev-udeb - /dev/ and hotplug management daemon (udeb)
Closes: 739676 742048 768644 774335 775067 775331 775404 775889 775903
Changes:
systemd (218-4) experimental; urgency=medium
.
[ Michael Biebl ]
* sysv-generator: handle Provides: for non-virtual facility names.
(Closes: #774335)
* Fix systemd-remount-fs.service to not fail on remounting /usr if /usr
isn't mounted yet. This happens with initramfs-tools < 0.118 which we
might not get into Jessie any more. (Closes: #742048)
.
[ Martin Pitt ]
* fstab-generator: Handle mountall's non-standard "nobootwait" and
"optional" options. ("bootwait" is already the systemd default behaviour,
and "showthrough" is irrelevant here, so both can be ignored).
* Add autopkgtest for one-time boot with upstart when systemd-sysv is
installed. This test only works under Ubuntu which has a split out
upstart-bin package, and will be skipped under Debian.
* debian/ifup@.service: Check if ifup succeeds by calling ifquery, to
work around ifup not failing on invalid interfaces (see #773539)
* debian/ifup@.service: Set proper service type (oneshot).
* sysv-generator: Handle .sh suffixes when translating Provides:.
(Closes: #775889)
* sysv-generator: Make real units overwrite symlinks generated by Provides:
from other units. Fixes failures due to presence of backup or old init.d
scripts. (Closes: #775404)
* Fix journal forwarding to syslog in containers without CAP_SYS_ADMIN.
(Closes: #775067)
* Re-enable AppArmor support, now that libapparmor1 moved to /lib. Add
versioned dependency as long as this is still only in experimental.
(Closes: #775331)
* Add some missing dpkg and ucf temp files to the "hidden file" filter, to
e. g. avoid creating units for them through the sysv-generator.
(Closes: #775903)
* Silence useless warning about /etc/localtime not being a symlink. This is
deliberate in Debian with /usr (possibly) being on a separate partition.
(LP: #1409594)
.
[ Christian Kastner ]
* Use common-session-noninteractive in systemd-user's PAM config, instead of
common-session. The latter can include PAM modules like libpam-mount which
expect to be called just once and/or interactively, which already happens
for login, ssh, or the display-manager. Add pam_systemd.so explicitly, as
it's not included in -noninteractive, but is always required (and
idempotent). There is no net change on systemd which don't use manually
installed PAM modules. (Closes: #739676)
.
[ Michael Biebl ]
* Make sure we run debian-fixup.service after /var has been mounted if /var
is on a separate partition. Otherwise we might end up creating the
/var/lock and /var/run symlink in the underlying root filesystem.
(Closes: #768644)
Checksums-Sha1:
f1529f55ba86808889ae79da53bba5da76c8a166 4144 systemd_218-4.dsc
250a163535fbfbc7548b8096391973aad094ec88 132664 systemd_218-4.debian.tar.xz
55752877daa436c3368e5cc03988bb27f71026df 3095102 systemd_218-4_amd64.deb
eea25a5341bceedc9751b1d5c74c469449f7912d 33792 systemd-sysv_218-4_amd64.deb
297823f5ec1df882d8c768ee4ed040563706f960 131276 libpam-systemd_218-4_amd64.deb
5d866f00319109611a765e33eec14b5484a047f5 92546 libsystemd0_218-4_amd64.deb
1b3ae14839cb9162d66d38e43babec426fe08b77 94324 libsystemd-dev_218-4_amd64.deb
99b1c17b108a89f59a2db3dfb46600032302c70b 47966
libsystemd-login0_218-4_amd64.deb
fb70066e022059606e0bb1ba9602dc6137034f47 29380
libsystemd-login-dev_218-4_amd64.deb
91b13e4e8f9eaf8ffa02965ad89f9e21eb3cc692 36804
libsystemd-daemon0_218-4_amd64.deb
dad68f41fc51bc7de53e9e87e094fb9f41c7887a 29406
libsystemd-daemon-dev_218-4_amd64.deb
4af3f622bb7195b16f166302e3e46d088a945121 77986
libsystemd-journal0_218-4_amd64.deb
141233db1d88030e67dbf6db708dd26cd38cc0ad 29376
libsystemd-journal-dev_218-4_amd64.deb
938ddb43031ba84581202a792db33a8428f5222e 35812
libsystemd-id128-0_218-4_amd64.deb
68907f1fcc1847975393dbcba3efde4412ca5166 29372
libsystemd-id128-dev_218-4_amd64.deb
7e5817464ab388d659b73b245a1ab75198f023a6 918660 udev_218-4_amd64.deb
61b8ae3437a291afbad52322b0c12c284e3532aa 55558 libudev1_218-4_amd64.deb
88c32dc4dcef08f7f07f8f2bec9473561b5d4b57 22996 libudev-dev_218-4_amd64.deb
05f32ebee497a607093121626d8e57a48eae054c 223278 udev-udeb_218-4_amd64.udeb
8051207cf9fe224e7d820a3ff159b38d9460aa7c 26566 libudev1-udeb_218-4_amd64.udeb
20cce96f0c39e4b0118f2a074f6e1009f33e104c 39738 libgudev-1.0-0_218-4_amd64.deb
b3badf6e5e9a59a2423bdb49d941206e8ae08c16 2830 gir1.2-gudev-1.0_218-4_amd64.deb
b5f29b99577fa47111c852728622c86ba9326ffa 24510 libgudev-1.0-dev_218-4_amd64.deb
f29724c643474a19f26ea685ece91875d90c7383 59568 python3-systemd_218-4_amd64.deb
60bcd61aa91800f07ad7caaaa95fa3a9ad0fc3d1 20264984 systemd-dbg_218-4_amd64.deb
Checksums-Sha256:
ff5e1be8820051b908c36acc5d73d3d19fb9bc5952177418f1265f67c2885450 4144
systemd_218-4.dsc
22eec2685f24bfc9077de8efac35fe19766898a75f36596b84b52d807d70248c 132664
systemd_218-4.debian.tar.xz
4aaac5f79df061f7d31b2b7dec907970c46d1d486b8dee9d482cbdb9cfca395f 3095102
systemd_218-4_amd64.deb
15ca00ab46b61fd9fdc24408ac9f5d9874bfc951a5e44000888fe37a49e43e18 33792
systemd-sysv_218-4_amd64.deb
d4f435a5fd1276324444afab771333156d5509a65c7f724140844f2f70839a17 131276
libpam-systemd_218-4_amd64.deb
5bcca775133b193f389045918d950edbd67d0c2e8d777ac71e660ae45ad65434 92546
libsystemd0_218-4_amd64.deb
4a1f8732b126a905c71023d8e92eae8acd9517258b5f9de076794cde9785c4a3 94324
libsystemd-dev_218-4_amd64.deb
932033f19e6dd9d0b1640431ed9f2e3caaaf9bad4e967316e67ca0fd2bce79db 47966
libsystemd-login0_218-4_amd64.deb
130ae18f71697e2dfdf551348dcd7b71b32582adb1792b54c4f72024edce7a3f 29380
libsystemd-login-dev_218-4_amd64.deb
bbfcb0d0c518eb8647ad5c3bbf916b3ef790ad6aa1214920207f8247c9b2b027 36804
libsystemd-daemon0_218-4_amd64.deb
842c6583215ff98c55d1e86e5df7e92dd3c42b7e31738569aceb60f86028558a 29406
libsystemd-daemon-dev_218-4_amd64.deb
e47595ac9cb789ffb71f8db55d7515f30b64cb7bb850d2b682e676e5c89f65c6 77986
libsystemd-journal0_218-4_amd64.deb
e954f5fc60e2db9ca31bca96941f68a6a036787cd71b39de225f3014da5fa12e 29376
libsystemd-journal-dev_218-4_amd64.deb
67cbfaa13742733ced481a713c89a166072e151dabccb90d8a55db3b2d2b4fc8 35812
libsystemd-id128-0_218-4_amd64.deb
e390d78ee9f7b28cf4696433df99a0258054bafc0656664ed69dbec538d75cc1 29372
libsystemd-id128-dev_218-4_amd64.deb
6adada4476f65bb04d6e12860989f30a570e69bae7dffeadd4919e53e60d2b8b 918660
udev_218-4_amd64.deb
54962aca400be5cbdc4de9dea02f107f7c3ba184ebeaf127c8c49eef47a3cda2 55558
libudev1_218-4_amd64.deb
60dc77f781bdf9a42b65060aa5e676662a5692802bc5cc142bbe5c9675b7ae1c 22996
libudev-dev_218-4_amd64.deb
86f077be68a34b481f9ed1eaa2e68083bb1c81e69fa31016ff51129200fddc6e 223278
udev-udeb_218-4_amd64.udeb
841595dfffcd3ca2df42a68c10b364fd6c2da0d96bbceed1142b63db3a75339c 26566
libudev1-udeb_218-4_amd64.udeb
2b6972e520e273a6e29339b892b8ede516ea6c6080ba1e03cbe9e8f25ecba34d 39738
libgudev-1.0-0_218-4_amd64.deb
80eb4345fb4794a456b791c298b7f39f0eac96832df74d010efae59c72e50626 2830
gir1.2-gudev-1.0_218-4_amd64.deb
72b4abb54f261b587c715e902e28ad649ccdf8a29706682f77762137621fd179 24510
libgudev-1.0-dev_218-4_amd64.deb
cb0af8330f295b6c935377e99f741a0576d08185c070aed75a6549ca384be7eb 59568
python3-systemd_218-4_amd64.deb
bff047edeef21caa6764ca7e41902863dced13ac573ef98aacd3ddd92f36bf98 20264984
systemd-dbg_218-4_amd64.deb
Files:
9d9e7480740a123d5640d6b9042fdb8a 4144 admin optional systemd_218-4.dsc
83f459a4820fb5aee8df6d2e1217cc31 132664 admin optional
systemd_218-4.debian.tar.xz
c80ba60eda76398007e725baa19f9151 3095102 admin optional systemd_218-4_amd64.deb
9463b3caf62b47540c833289d891a419 33792 admin extra systemd-sysv_218-4_amd64.deb
a8d17f5c2d57742ad0503501624e1e0b 131276 admin optional
libpam-systemd_218-4_amd64.deb
e50cd8f212eae2208c449b870d890892 92546 libs optional
libsystemd0_218-4_amd64.deb
1050883fc0af8b1f002f7432809e197d 94324 libdevel optional
libsystemd-dev_218-4_amd64.deb
bb79c4f36fb8eb15233ddf6a6e04bd80 47966 oldlibs extra
libsystemd-login0_218-4_amd64.deb
809f222d1a5bfd4dd9362363ed37edc0 29380 oldlibs extra
libsystemd-login-dev_218-4_amd64.deb
1eec41595e4ec4e891e2c1a076437f17 36804 oldlibs extra
libsystemd-daemon0_218-4_amd64.deb
0058c2b618e42f0f15840adcb077b7b2 29406 oldlibs extra
libsystemd-daemon-dev_218-4_amd64.deb
ff803054be0a910fe9db853c46f00994 77986 oldlibs extra
libsystemd-journal0_218-4_amd64.deb
6456e5aff7d274d57d203b96abf8d0f9 29376 oldlibs extra
libsystemd-journal-dev_218-4_amd64.deb
dbfaa8a7a3849c9cbeea51a4b917bfaa 35812 oldlibs extra
libsystemd-id128-0_218-4_amd64.deb
7c77c3e7202d3e0225110ff35c90d65b 29372 oldlibs extra
libsystemd-id128-dev_218-4_amd64.deb
30e3b5b298ece11e32eb4028b730a0ba 918660 admin important udev_218-4_amd64.deb
a012dcf77fa85cb94eaa1af9fe12d07e 55558 libs important libudev1_218-4_amd64.deb
e498527edc61738b75d279b957e7d6ba 22996 libdevel optional
libudev-dev_218-4_amd64.deb
83062f1154f0365544bf5d41ec21dba4 223278 debian-installer optional
udev-udeb_218-4_amd64.udeb
61d92ed2cf3930a37a045eca3fc3862a 26566 debian-installer optional
libudev1-udeb_218-4_amd64.udeb
fbc8dbad759d8d7db8098ef4f072d85f 39738 libs optional
libgudev-1.0-0_218-4_amd64.deb
d3fc65d7e6c2a623d8d1715228cd95d5 2830 introspection optional
gir1.2-gudev-1.0_218-4_amd64.deb
75e361414c095f3c3cdaf1674444655d 24510 libdevel optional
libgudev-1.0-dev_218-4_amd64.deb
eaa7b77edc919810c120ea3a9b4c2676 59568 python optional
python3-systemd_218-4_amd64.deb
84f990492ef7155dff71ea5eceb92fd5 20264984 debug extra
systemd-dbg_218-4_amd64.deb
Package-Type: udeb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCAAGBQJUv8KdAAoJENFO8V2v4RNH9H0P/iajJ45r/44BKGpjxGQMTJAX
YituIMEirPIqxVFRvlw+qMjQpqPWgVHgvCOL0AwkG4J8HMyk3/dABqY4RRz05e62
cb/noNGkw2yq+JPym4tHDT8mVbfRvxuoqXAjBb+kmWc+dQ4xrhhVYavL3XvwG8WP
skKFf2vhUuTPxogbBwy+FukGtlyWjVVi1XQgnDu2GLCLw8dWqUpuoWVFUIAHd+t+
3sSEB9BvzePHhJQkLhUp4lBHxGY8nv9pEP2+N6UI/bnGj3Uf6h/e5ShUMmHO0yif
NrqBG8enGFMF+NWBnVxbK5rRuLu5x3QjM1bVmOFj/tNIdjA4y9o2NO5XUMfsMAOq
vahKUJONW+rv2Zijnqc0hwSt5ruACVQI302wGpu9ZaPXqzK+rc8h7PiWmlwRitQh
9ajQAhkalDU4eKge/Xfm/3rMjEfVBclXYJV8rUOkPHwm7PAow+AxFcbTYUuxb394
ocaeCwFGsFaLr0Sh5gijveGYIj/0hp2G3stq2UAomYXfk19b+nwuXWYEWWYhkVy2
8mMEYzg/Yr0+16q9Rm9cpvG+T5Q9xAOksgEFLyjg1Ag+vnj2NZA7iLR4/xbddG9W
AdJPKcfedMtS2ASszJeV9t+gprgx7B+GQVrEI5HyDfJYmwMyo3NSernunjg0gJJ+
dMutFwqarhJnoImge9D/
=ebHl
-----END PGP SIGNATURE-----
--- End Message ---