Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #158841 > unrolled thread

/etc/resolv.conf being blanked

Back to article view | Back to linux.debian.user

Contents

  /etc/resolv.conf being blanked Dominic Hargreaves <dom@earth.li> - 2015-10-11 13:10 +0200
    Re: /etc/resolv.conf being blanked <tomas@tuxteam.de> - 2015-10-11 13:20 +0200
      Re: /etc/resolv.conf being blanked tomas@tuxteam.de - 2015-10-11 13:30 +0200
      Re: /etc/resolv.conf being blanked Dominic Hargreaves <dom@earth.li> - 2015-10-11 13:30 +0200
        Re: /etc/resolv.conf being blanked Reco <recoverym4n@gmail.com> - 2015-10-11 13:40 +0200
          Re: /etc/resolv.conf being blanked <tomas@tuxteam.de> - 2015-10-11 14:10 +0200
        Re: /etc/resolv.conf being blanked Pascal Hambourg <pascal@plouf.fr.eu.org> - 2015-10-11 14:10 +0200
          Re: /etc/resolv.conf being blanked Dominic Hargreaves <dom@earth.li> - 2015-10-11 16:00 +0200
            Re: /etc/resolv.conf being blanked Pascal Hambourg <pascal@plouf.fr.eu.org> - 2015-10-11 20:00 +0200
              Re: /etc/resolv.conf being blanked Dominic Hargreaves <dom@earth.li> - 2015-10-11 23:20 +0200

#158841 — /etc/resolv.conf being blanked

[Please CC me on replies]

Hi,

On my freshly installed Debian jessie system, running XFCE and
Network Manager, I'm seeing /etc/resolv.conf being blanked every so
often (it seems to be about every 20 minutes). I can't see what is doing
this; there's nothing in the system logs which correlates with this event.

I can't find anything on the web about this exact situation; plenty
of people talking about NetworkManager overwriting the file
unexpectedly, but not with it being completely blank. Immediately
after NM has activated the connection, resolv.conf is fine.

Does anyone have any thoughts about what might be going on or how to
investigate further?

Cheers,
Dominic.

[toc] | [next] | [standalone]

#158842

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Sun, Oct 11, 2015 at 12:05:53PM +0100, Dominic Hargreaves wrote:
> [Please CC me on replies]
> 
> Hi,
> 
> On my freshly installed Debian jessie system, running XFCE and
> Network Manager, I'm seeing /etc/resolv.conf being blanked every so
> often (it seems to be about every 20 minutes). I can't see what is doing
> this; there's nothing in the system logs which correlates with this event.

See my other post: the brutal (but effective) self-defense tool I used
(back then, when NM was yet allowed on my boxes ;-) was to "chattr +i"
the file. With some luck I'd find complaints in the log files which helped
clear up which program (and in which context) was trying to do something
to the files.

The nice part of chattr is that it protects the direntry too (so the
obvious fall-back of removing and re-creating doesn't help).

Regards
- -- tomás
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlYaPEYACgkQBcgs9XrR2kYGyQCcDKv1KZ2hbKspXFQSesQ0MEXs
V/4AnRNb+K6S3+hezZ1/pp2OJrms7tD3
=zrck
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#158848

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Sun, Oct 11, 2015 at 12:23:03PM +0100, Dominic Hargreaves wrote:
> On Sun, Oct 11, 2015 at 12:39:02PM +0200, tomas@tuxteam.de wrote:
> > On Sun, Oct 11, 2015 at 12:05:53PM +0100, Dominic Hargreaves wrote:
> > > [Please CC me on replies]
> > > 
> > > Hi,
> > > 
> > > On my freshly installed Debian jessie system, running XFCE and
> > > Network Manager, I'm seeing /etc/resolv.conf being blanked every so
> > > often (it seems to be about every 20 minutes). I can't see what is doing
> > > this; there's nothing in the system logs which correlates with this event.
> > 
> > See my other post: the brutal (but effective) self-defense tool I used
> > (back then, when NM was yet allowed on my boxes ;-) was to "chattr +i"
> > the file. With some luck I'd find complaints in the log files which helped
> > clear up which program (and in which context) was trying to do something
> > to the files.
> > 
> > The nice part of chattr is that it protects the direntry too (so the
> > obvious fall-back of removing and re-creating doesn't help).
> 
> But I *want* NM to update the file, and I don't have any evidence that
> it's NM blanking it here. So preventing updates isn't what I want.
> 
> Having said that, you're right that looking for complaints could be
> an effective debugging tool. I'll give that a go.

Yes, that was my primary aim too :-)

Some day those i-do-everything-and-i-know-better-than-you programs will
learn about chattr. Then we're hosed; so please you do it very quietly
and don't tell anybody ;-D

> I did just notice that there is a third state that the file sometimes
> ends up in, as well as the expected one which begins "Generated by
> Network Manager". This is a file which just contains one nameserver
> entry containing the IPv6 resolver. Odd.

Indeed.

regards
- -- tomás
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlYaP8QACgkQBcgs9XrR2kbrGACeP0iySkaeEXhIuqiycM5kheVP
PHYAnj/fK1zD43PuYWSN8leV8jEUWa1t
=b0Yg
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#158849

On Sun, Oct 11, 2015 at 12:39:02PM +0200, tomas@tuxteam.de wrote:
> On Sun, Oct 11, 2015 at 12:05:53PM +0100, Dominic Hargreaves wrote:
> > [Please CC me on replies]
> > 
> > Hi,
> > 
> > On my freshly installed Debian jessie system, running XFCE and
> > Network Manager, I'm seeing /etc/resolv.conf being blanked every so
> > often (it seems to be about every 20 minutes). I can't see what is doing
> > this; there's nothing in the system logs which correlates with this event.
> 
> See my other post: the brutal (but effective) self-defense tool I used
> (back then, when NM was yet allowed on my boxes ;-) was to "chattr +i"
> the file. With some luck I'd find complaints in the log files which helped
> clear up which program (and in which context) was trying to do something
> to the files.
> 
> The nice part of chattr is that it protects the direntry too (so the
> obvious fall-back of removing and re-creating doesn't help).

But I *want* NM to update the file, and I don't have any evidence that
it's NM blanking it here. So preventing updates isn't what I want.

Having said that, you're right that looking for complaints could be
an effective debugging tool. I'll give that a go.

I did just notice that there is a third state that the file sometimes
ends up in, as well as the expected one which begins "Generated by
Network Manager". This is a file which just contains one nameserver
entry containing the IPv6 resolver. Odd.

Cheers,
Dominic.

[toc] | [prev] | [next] | [standalone]

#158850

	Hi.

On Sun, 11 Oct 2015 12:23:03 +0100
Dominic Hargreaves <dom@earth.li> wrote:

> On Sun, Oct 11, 2015 at 12:39:02PM +0200, tomas@tuxteam.de wrote:
> > On Sun, Oct 11, 2015 at 12:05:53PM +0100, Dominic Hargreaves wrote:
> > > [Please CC me on replies]
> > > 
> > > Hi,
> > > 
> > > On my freshly installed Debian jessie system, running XFCE and
> > > Network Manager, I'm seeing /etc/resolv.conf being blanked every so
> > > often (it seems to be about every 20 minutes). I can't see what is doing
> > > this; there's nothing in the system logs which correlates with this event.
> > 
> > See my other post: the brutal (but effective) self-defense tool I used
> > (back then, when NM was yet allowed on my boxes ;-) was to "chattr +i"
> > the file. With some luck I'd find complaints in the log files which helped
> > clear up which program (and in which context) was trying to do something
> > to the files.
> > 
> > The nice part of chattr is that it protects the direntry too (so the
> > obvious fall-back of removing and re-creating doesn't help).
> 
> But I *want* NM to update the file, and I don't have any evidence that
> it's NM blanking it here. So preventing updates isn't what I want.
> 
> Having said that, you're right that looking for complaints could be
> an effective debugging tool. I'll give that a go.

Setting immutable bit is a crude, but effective technique indeed. But
there's less destructive approach called auditd.

Install it, start it, invoke

auditctl -w /etc/resolv.conf -p wa

Watch the results in /var/log/audit.


To disable watching, invoke

auditctl -W /etc/resolv.conf

Reco

[toc] | [prev] | [next] | [standalone]

#158854

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Sun, Oct 11, 2015 at 02:34:04PM +0300, Reco wrote:

[...]

> Setting immutable bit is a crude,

definitely :-)

>                                   but effective technique indeed. But
> there's less destructive approach called auditd.

Thanks for this hint. May turn useful some day. To be honest, I expected
some massive thing playing LD_PRELOAD games, but it seems that most of
the work is done in the kernel's audit framework.

Regards
- -- tomás
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlYaSP8ACgkQBcgs9XrR2kbXUQCfZQM+NoHcCoBR17ctrZoGg00q
NnEAni+KOfjIhtbo8lDSNF2BD2KmU4w2
=HLvV
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#158856

Dominic Hargreaves a écrit :
> 
> I did just notice that there is a third state that the file sometimes
> ends up in, as well as the expected one which begins "Generated by
> Network Manager". This is a file which just contains one nameserver
> entry containing the IPv6 resolver. Odd.

That may be generated from received IPv6 router advertisements (RA) by
rdnssd if installed. In that case, you can remove this package if you
don't need DNS resolution through the IPv6 server. Otherwise, check
whether the package resolvconf is installed.

[toc] | [prev] | [next] | [standalone]

#158869

On Sun, Oct 11, 2015 at 01:47:57PM +0200, Pascal Hambourg wrote:
> Dominic Hargreaves a écrit :
> > 
> > I did just notice that there is a third state that the file sometimes
> > ends up in, as well as the expected one which begins "Generated by
> > Network Manager". This is a file which just contains one nameserver
> > entry containing the IPv6 resolver. Odd.
> 
> That may be generated from received IPv6 router advertisements (RA) by
> rdnssd if installed. In that case, you can remove this package if you
> don't need DNS resolution through the IPv6 server. Otherwise, check
> whether the package resolvconf is installed.

Aha! Thanks for the clue.

The problem appears to have gone away after removing rdnssd, so I assume
it was a particularly severe case of #740998 (an RC bug which was sadly
not fixed in jessie).

I'll follow up on that bug (and probably a new bug against
debian-installer to have rdnssd not installed).

Thanks,
Dominic.

[toc] | [prev] | [next] | [standalone]

#158886

Dominic Hargreaves a écrit :
> On Sun, Oct 11, 2015 at 01:47:57PM +0200, Pascal Hambourg wrote:
>>
>> That may be generated from received IPv6 router advertisements (RA) by
>> rdnssd if installed. In that case, you can remove this package if you
>> don't need DNS resolution through the IPv6 server. Otherwise, check
>> whether the package resolvconf is installed.
> 
> Aha! Thanks for the clue.
> 
> The problem appears to have gone away after removing rdnssd, so I assume
> it was a particularly severe case of #740998 (an RC bug which was sadly
> not fixed in jessie).

Even though I was aware of issues with rdnssd, I didn't know about this
RC bug. I'll check it.

> I'll follow up on that bug (and probably a new bug against
> debian-installer to have rdnssd not installed).

Problem is, rdnssd is required in an IPv6-only network with
autoconfiguration in order to fill /etc/resolv.conf, or a dual-stack
network with only autoconfigured IPv6 DNS. IME, installing resolvconf
solves the competition between the different DNS sources (RDNSS, DHCP
client, Network Manager...) for resolv.conf.

[toc] | [prev] | [next] | [standalone]

#158918

On Sun, Oct 11, 2015 at 07:37:24PM +0200, Pascal Hambourg wrote:
> Dominic Hargreaves a écrit :
> > On Sun, Oct 11, 2015 at 01:47:57PM +0200, Pascal Hambourg wrote:
> >>
> >> That may be generated from received IPv6 router advertisements (RA) by
> >> rdnssd if installed. In that case, you can remove this package if you
> >> don't need DNS resolution through the IPv6 server. Otherwise, check
> >> whether the package resolvconf is installed.
> > 
> > Aha! Thanks for the clue.
> > 
> > The problem appears to have gone away after removing rdnssd, so I assume
> > it was a particularly severe case of #740998 (an RC bug which was sadly
> > not fixed in jessie).
> 
> Even though I was aware of issues with rdnssd, I didn't know about this
> RC bug. I'll check it.
> 
> > I'll follow up on that bug (and probably a new bug against
> > debian-installer to have rdnssd not installed).
> 
> Problem is, rdnssd is required in an IPv6-only network with
> autoconfiguration in order to fill /etc/resolv.conf, or a dual-stack
> network with only autoconfigured IPv6 DNS. IME, installing resolvconf
> solves the competition between the different DNS sources (RDNSS, DHCP
> client, Network Manager...) for resolv.conf.

>From what I've read NM can do this and thus rdnssd is not required.
It's certainly picking up the IPv6 resolver in my dual-stack network -
it would be surprising if it behaved differently on a v6-only network.

Dominic.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web