Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1251482

Bug#1108377: chkrootkit: daily system event: mail: /tmp/mail.RsXXXX8kWKZT: Read-only file system

Show all headers | View raw

On Fri, 27 Jun 2025 at 10:17, Holger Levsen <holger@debian.org> wrote:

> since I've upgraded systems to trixie, logcheck mails me daily system events like these:
>
> Jun 27 00:01:21 hostname chkrootkit-daily[2588815]: sending alert to root: [chkrootkit] alert for hostname.example.org
> Jun 27 00:01:21 hostname chkrootkit-daily[2589917]: mail: /tmp/mail.RsXXXX8kWKZT: Read-only file system

> Obviously I can rather easily ignore those in logcheck but I would like to know
> what's going on first. Do you have any idea?

I have 2 thoughts, one is that we set ProtectSystem=strict so /tmp is
read-only when the unit runs: However, we set
Environment=TMPDIR=/run/chkrootkit which should mean things dont write
to /tmp --- maybe your email sending setup ignores TMPDIR? are you
using something non-standard?

You should be able to fix this with running systemctl edit chkrootkit
and making a drop-in with

[Service]
ReadWritePaths=/tmp

That should fix it. Depending on how unusual your system is, we might
want to add this for trixie, (or maybe disable the protectsystem)

(If that's not it, it may be another instance of #1106030, but it
looks different)

Either way you probably shouldn't ignore these lines with logcheck: it
looks like it is trying to email you and failing

Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Bug#1108377: chkrootkit: daily system event: mail: /tmp/mail.RsXXXX8kWKZT: Read-only file system Holger Levsen <holger@debian.org> - 2025-06-27 11:20 +0200
  Bug#1108377: chkrootkit: daily system event: mail: /tmp/mail.RsXXXX8kWKZT: Read-only file system Richard Lewis <richard.lewis.debian@googlemail.com> - 2025-06-30 20:30 +0200
    Bug#1108377: chkrootkit: daily system event: mail: /tmp/mail.RsXXXX8kWKZT: Read-only file system Richard Lewis <richard.lewis.debian@googlemail.com> - 2025-06-30 22:00 +0200
      Bug#1108377: chkrootkit: daily system event: mail: /tmp/mail.RsXXXX8kWKZT: Read-only file system Holger Levsen <holger@layer-acht.org> - 2025-06-30 22:10 +0200
    Bug#1108377: chkrootkit: daily system event: mail: /tmp/mail.RsXXXX8kWKZT: Read-only file system Holger Levsen <holger@layer-acht.org> - 2025-07-06 01:00 +0200
  Bug#1108377: chkrootkit: daily system event: mail: /tmp/mail.RsXXXX8kWKZT: Read-only file system Holger Levsen <holger@layer-acht.org> - 2025-07-06 13:10 +0200
    Bug#1108377: chkrootkit: daily system event: mail: /tmp/mail.RsXXXX8kWKZT: Read-only file system Richard Lewis <richard.lewis.debian@googlemail.com> - 2025-07-06 14:00 +0200
  Bug#1108377: bsd-mailx: allow TMPDIR env to override /tmp Andrew Bower <andrew@bower.uk> - 2025-07-11 08:00 +0200

csiph-web