Re: Debugging what is deleting/recreating /etc/resolv.conf with wrong configuration, on debian stable

From	davenull@tuxfamily.org
Newsgroups	linux.debian.user
Subject	Re: Debugging what is deleting/recreating /etc/resolv.conf with wrong configuration, on debian stable
Date	2023-02-23 10:50 +0100
Message-ID	<G2goF-7TM7-1@gated-at.bofh.it> (permalink)
References	<G20WC-7JT0-5@gated-at.bofh.it> <G24xb-7M9K-17@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

Hello

On 2023-02-22 22:08, David Wright wrote:
> On Wed 22 Feb 2023 at 18:12:29 (+0100), davenull@tuxfamily.org wrote:
> 
>> What I want is: setting up /etc/resolv.conf ONLY
>> -  at system startup/initial network connexion.
>> - when openconnect is executed and connects to work's VPN
>> - when openconnect is ^C-ed and disconnects from the works VPN
>> (cleaning it's mess in the routing table, interfaces, /etc/resolv's
>> and other netwwork stuff it might have modified, makes sense)
> 
> What's the output from   ls -l /etc/resolv.conf
> 

-rw-r--r-- 1 root root 104 23 févr. 09:35 /etc/resolv.conf

With the ctime changing more or less often, since it is 
deleted/recreated by what I suspect to do DHCP requests (see audit.log)

> What's responsible for restoring the previous contents of
> /etc/resolv.conf to your normal network connection when you
> finish "work" and tear down the VPN.

openconnect does. When it's CTRL-C-ed to disconnect from the workplace 
VPN, resolv.conf is reverted back to my home network resolver
Not sure whether vpnc_script just calls the DHCP client (probably 
dhclient since it's the only dhcp client preinstalled, at least I'm 
aware of)

> 
>> - I don't use systemd-resolvd. My OS image (Debian stable, LXDE,
>> connmann as the default network manager) ships with systemd-resolvd
>> disabled and I'm totally OK with it
>> - I do use connmann and didn't replace it with anything else
>> - The process that deletes and recreates /etc/resolv.conf runs as
>> root. I used auditd to detect when changes that file… but I can't a
>> get any process name. I can just see it's root
> 
> One way of finding the process is to  # chattr +i /etc/resolv.conf
> while you're "at work", so that you get permission errors in the
> logs when it happens. (Remember to chattr -i before you "stop work".)

Thank you. I'll give it a try, But I won't be on remote work before next 
week
Which log file is used for that?
So instead of grepping /var/log/ recursively when the problem occurs. 
I'd tail -f the right file to find the "rogue" process right away

> 
> But how do you manage /etc/resolv.conf with connman. I don't use it,

openconnect uses something called vpnc_script.
When openconnects is exc, resolv.conf contains the appropriate info as 
well a comment including "VPNC_GENERATED"

> but I read there's a plug-in for that. Is openconnect correctly
> informing connman when it finishes.

Whether it informs connmann or cleans after itself without involving 
connmann, I don't know and I'm not sure how to check that out.
I'm not familiar with how vpnc_script works and what it does _exactly_
But it does clean up the config and network config is left in working 
state when openconnect disconnects

> 
>> I was expecting to see a process name it the audit.log file BUT it
>> didn't happened so I'm still stuck. so my question is: How to debug
>> that further, and identify the exact process that screw up with
>> /etc/resolv.conf file… So from there I could search for a way to
>> prevent that by modifying the rights config file or whatever…
> 
> Whatever the "rogue process" is should be informing whatever the
> "/etc/resolv.conf controller" is, shouldn't it, rather than being
> blocked. (It might be legitimate rather than "rogue".)

Yes, I certainly don't want to block the process entirely, I just want 
to find some mechanism that works in the following way

"Leave /etc/resolv.conf alone, ONLY IF you're not openconnect/a 
vpnc_script AND WHEN openconnect is running"

Otherwise, when VPN is disconnected, I DO want /etc/resolv.conf to be 
generated according to my home router's DHCP tells the computer

Thank you for your help either way. It gives me some interesting 
pointers :)

> 
> Cheers,
> David.

Thread

Debugging what is deleting/recreating /etc/resolv.conf with wrong  configuration, on debian stable davenull@tuxfamily.org - 2023-02-22 18:20 +0100
  Re: Debugging what is deleting/recreating /etc/resolv.conf with  wrong configuration, on debian stable Roberto C. Sánchez <roberto@debian.org> - 2023-02-22 18:30 +0100
  Re: Debugging what is deleting/recreating /etc/resolv.conf with  wrong configuration, on debian stable Christoph Brinkhaus <c.brinkhaus@t-online.de> - 2023-02-22 18:40 +0100
    Re: Debugging what is deleting/recreating /etc/resolv.conf with wrong  configuration, on debian stable davenull@tuxfamily.org - 2023-02-23 11:40 +0100
      Re: Debugging what is deleting/recreating /etc/resolv.conf with  wrong configuration, on debian stable Reco <recoverym4n@enotuniq.net> - 2023-02-23 18:20 +0100
  Re: Debugging what is deleting/recreating /etc/resolv.conf with  wrong configuration, on debian stable Greg Wooledge <greg@wooledge.org> - 2023-02-22 19:30 +0100
  Re: Debugging what is deleting/recreating /etc/resolv.conf with  wrong configuration, on debian stable David Wright <deblis@lionunicorn.co.uk> - 2023-02-22 22:10 +0100
    Re: Debugging what is deleting/recreating /etc/resolv.conf with wrong  configuration, on debian stable davenull@tuxfamily.org - 2023-02-23 10:50 +0100
      Re: Debugging what is deleting/recreating /etc/resolv.conf with  wrong configuration, on debian stable <tomas@tuxteam.de> - 2023-02-23 11:00 +0100
        Re: Debugging what is deleting/recreating /etc/resolv.conf with wrong  configuration, on debian stable davenull@tuxfamily.org - 2023-02-23 11:40 +0100
      Re: Debugging what is deleting/recreating /etc/resolv.conf with  wrong configuration, on debian stable David Wright <deblis@lionunicorn.co.uk> - 2023-02-24 06:40 +0100
        Re: Debugging what is deleting/recreating /etc/resolv.conf with  wrong configuration, on debian stable <tomas@tuxteam.de> - 2023-02-24 06:50 +0100
        Re: Debugging what is deleting/recreating /etc/resolv.conf with wrong  configuration, on debian stable davenull@tuxfamily.org - 2023-02-24 10:30 +0100
          Re: Debugging what is deleting/recreating /etc/resolv.conf with  wrong configuration, on debian stable <tomas@tuxteam.de> - 2023-02-24 10:30 +0100
            Re: Debugging what is deleting/recreating /etc/resolv.conf with wrong  configuration, on debian stable davenull@tuxfamily.org - 2023-02-24 11:30 +0100
              Re: Debugging what is deleting/recreating /etc/resolv.conf with  wrong configuration, on debian stable tomas@tuxteam.de - 2023-02-24 11:50 +0100
              Re: Debugging what is deleting/recreating /etc/resolv.conf with wrong  configuration, on debian stable davenull@tuxfamily.org - 2023-02-27 15:20 +0100
                Re: Debugging what is deleting/recreating /etc/resolv.conf with  wrong configuration, on debian stable Greg Wooledge <greg@wooledge.org> - 2023-02-27 15:40 +0100
          Re: Debugging what is deleting/recreating /etc/resolv.conf with  wrong configuration, on debian stable Greg Wooledge <greg@wooledge.org> - 2023-02-24 13:30 +0100
          Re: Debugging what is deleting/recreating /etc/resolv.conf with  wrong configuration, on debian stable David Wright <deblis@lionunicorn.co.uk> - 2023-02-25 01:30 +0100
          Forcing dhclient to not ignore tun0 interface when it's available davenull@tuxfamily.org - 2023-03-02 11:50 +0100
            Re: Forcing dhclient to not ignore tun0 interface when it's  available Tim Woodall <debianuser@woodall.me.uk> - 2023-03-03 04:10 +0100
              Re: Forcing dhclient to not ignore tun0 interface when it's available Max Nikulin <manikulin@gmail.com> - 2023-03-03 06:30 +0100
                Re: Forcing dhclient to not ignore tun0 interface when it's  available Tim Woodall <debianuser@woodall.me.uk> - 2023-03-03 07:40 +0100
                Re: Forcing dhclient to not ignore tun0 interface when it's available Max Nikulin <manikulin@gmail.com> - 2023-03-03 16:10 +0100
                Re: Forcing dhclient to not ignore tun0 interface when it's available David Wright <deblis@lionunicorn.co.uk> - 2023-03-03 16:20 +0100
                Re: Forcing dhclient to not ignore tun0 interface when it's available davenull@tuxfamily.org - 2023-03-06 13:40 +0100
                Re: Forcing dhclient to not ignore tun0 interface when it's available David Wright <deblis@lionunicorn.co.uk> - 2023-03-07 05:10 +0100
                Re: Forcing dhclient to not ignore tun0 interface when it's available davenull@tuxfamily.org - 2023-03-07 17:20 +0100
                Re: Forcing dhclient to not ignore tun0 interface when it's available David Wright <deblis@lionunicorn.co.uk> - 2023-03-10 02:00 +0100
                Re: Forcing dhclient to not ignore tun0 interface when it's available davenull@tuxfamily.org - 2023-03-06 13:20 +0100
                Re: Forcing dhclient to not ignore tun0 interface when it's available David Wright <deblis@lionunicorn.co.uk> - 2023-03-07 05:10 +0100
                Re: Forcing dhclient to not ignore tun0 interface when it's available davenull@tuxfamily.org - 2023-03-07 17:00 +0100
                Re: Forcing dhclient to not ignore tun0 interface when it's available Max Nikulin <manikulin@gmail.com> - 2023-03-07 16:30 +0100
                Re: Forcing dhclient to not ignore tun0 interface when it's available davenull@tuxfamily.org - 2023-03-07 18:00 +0100
                Re: Forcing dhclient to not ignore tun0 interface when it's available David Wright <deblis@lionunicorn.co.uk> - 2023-03-10 02:00 +0100
                Re: Forcing dhclient to not ignore tun0 interface when it's available davenull@tuxfamily.org - 2023-03-10 09:50 +0100
            Re: Forcing dhclient to not ignore tun0 interface when it's available David Wright <deblis@lionunicorn.co.uk> - 2023-03-03 06:30 +0100
              Re: Forcing dhclient to not ignore tun0 interface when it's available davenull@tuxfamily.org - 2023-03-03 18:10 +0100
                Re: Forcing dhclient to not ignore tun0 interface when it's available David Wright <deblis@lionunicorn.co.uk> - 2023-03-04 18:40 +0100
  Re: Debugging what is deleting/recreating /etc/resolv.conf with wrong  configuration, on debian stable Cindy Sue Causey <butterflybytes@gmail.com> - 2023-02-23 02:30 +0100
    Re: Debugging what is deleting/recreating /etc/resolv.conf with wrong configuration, on debian stable conover@panix.com (John Conover) - 2023-02-23 03:20 +0100
      Re: Debugging what is deleting/recreating /etc/resolv.conf with wrong  configuration, on debian stable davenull@tuxfamily.org - 2023-02-23 11:30 +0100
        Re: Debugging what is deleting/recreating /etc/resolv.conf with wrong  configuration, on debian stable Jeremy Ardley <jeremy@ardley.org> - 2023-02-23 11:40 +0100
        Re: Debugging what is deleting/recreating /etc/resolv.conf with  wrong configuration, on debian stable David Wright <deblis@lionunicorn.co.uk> - 2023-02-28 05:30 +0100
          Re: Debugging what is deleting/recreating /etc/resolv.conf with wrong  configuration, on debian stable davenull@tuxfamily.org - 2023-02-28 16:10 +0100
            Re: Debugging what is deleting/recreating /etc/resolv.conf with  wrong configuration, on debian stable Tixy <tixy@yxit.co.uk> - 2023-02-28 17:00 +0100
            Re: Debugging what is deleting/recreating /etc/resolv.conf with  wrong configuration, on debian stable David Wright <deblis@lionunicorn.co.uk> - 2023-03-02 00:30 +0100
              Re: Debugging what is deleting/recreating /etc/resolv.conf with wrong  configuration, on debian stable davenull@tuxfamily.org - 2023-03-02 10:40 +0100
                Re: Debugging what is deleting/recreating /etc/resolv.conf with  wrong configuration, on debian stable Greg Wooledge <greg@wooledge.org> - 2023-03-02 13:40 +0100
                Re: Debugging what is deleting/recreating /etc/resolv.conf with wrong  configuration, on debian stable davenull@tuxfamily.org - 2023-03-02 13:50 +0100
                Re: Debugging what is deleting/recreating /etc/resolv.conf with wrong  configuration, on debian stable davenull@tuxfamily.org - 2023-03-02 14:10 +0100
                Re: Debugging what is deleting/recreating /etc/resolv.conf with  wrong configuration, on debian stable Greg Wooledge <greg@wooledge.org> - 2023-03-02 14:20 +0100
                Re: Debugging what is deleting/recreating /etc/resolv.conf with wrong  configuration, on debian stable davenull@tuxfamily.org - 2023-03-02 16:20 +0100
                Re: Debugging what is deleting/recreating /etc/resolv.conf with wrong  configuration, on debian stable David <bouncingcats@gmail.com> - 2023-03-02 16:40 +0100
                Re: Debugging what is deleting/recreating /etc/resolv.conf with wrong  configuration, on debian stable David <bouncingcats@gmail.com> - 2023-03-02 16:20 +0100
                Re: Debugging what is deleting/recreating /etc/resolv.conf with  wrong configuration, on debian stable Curt <curty@free.fr> - 2023-03-02 18:30 +0100
                Re: Debugging what is deleting/recreating /etc/resolv.conf with  wrong configuration, on debian stable David Wright <deblis@lionunicorn.co.uk> - 2023-03-02 19:20 +0100
                Re: Debugging what is deleting/recreating /etc/resolv.conf with  wrong configuration, on debian stable <tomas@tuxteam.de> - 2023-03-02 20:30 +0100
                Re: Debugging what is deleting/recreating /etc/resolv.conf with  wrong configuration, on debian stable David Wright <deblis@lionunicorn.co.uk> - 2023-03-03 06:20 +0100

csiph-web