Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1225965

Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles

Show all headers | View raw

On Sun, 15 Dec 2024 22:40:51 +0000 Julian Gilbey <jdg@debian.org> wrote:
> On Wed, Dec 11, 2024 at 11:43:18PM +0000, Richard Lewis wrote:
> > [...]
> > I think all it needs is
> > /etc/systemd/system/chkrootkit.service.d/override.conf with
> >
> > [Service]
> > ProtectSystem=strict
> >
> > (you can do "systemctl edit chkrootkit.service" and it will make such
> > a file and reload it,
> > you can then do systemctl start chkrootkit and it should be used)
> > That should solve the problem for the daily check. Can you see if that
> > it works. it's probably useful anyway)
>
> That works perfectly, thank you!

Quick update: I've been testing this, and whille it usually works it
can prevent the output being emailed with the following:

Dec 28 00:01:45 hostname chkrootkit-daily[4050677]: mail:
mu_temp_file_stream_create() failed: Read-only file system
Dec 28 00:01:45 hostname chkrootkit-daily[4050677]: mail:
mu_temp_file_stream_create() failed: Read-only file system
Dec 28 00:01:46 hostname exim[4050709]: 2024-12-28 00:01:46
1tRKH4-00Gzm1-00 Failed to create spool file
/var/spool/exim4//input//1tRKH4-00Gzm1-00-D: Read-only file system
Dec 28 00:01:46 hostname exim[4050709]: 2024-12-28 00:01:46
1tRKH4-00Gzm1-00 Cannot open main log file "/var/log/exim4/mainlog":
Permission denied: euid=109 egid=113
Dec 28 00:01:46 hostname exim[4050709]: exim: could not open panic log
- aborting: see message(s) above

I believe this only(?) happens if the report is large enough. i assume
we can allow more of /var to be read-write and avoid this
possibly the first error is from mailutils -- i remember failing to
identify this before, unfortunately without success.

Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles Julian Gilbey <jdg@debian.org> - 2024-12-09 13:50 +0100
  Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles Richard Lewis <richard.lewis.debian@googlemail.com> - 2024-12-09 23:50 +0100
    Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles Julian Gilbey <jdg@debian.org> - 2024-12-10 10:20 +0100
      Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles Richard Lewis <richard.lewis.debian@googlemail.com> - 2024-12-10 14:20 +0100
        Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles Julian Gilbey <jdg@debian.org> - 2024-12-11 17:00 +0100
          Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles Richard Lewis <richard.lewis.debian@googlemail.com> - 2024-12-12 00:50 +0100
            Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles Julian Gilbey <jdg@debian.org> - 2024-12-15 23:50 +0100
  Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles Richard Lewis <richard.lewis.debian@googlemail.com> - 2024-12-28 22:20 +0100
  Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles Richard Lewis <richard.lewis.debian@googlemail.com> - 2024-12-30 14:20 +0100

csiph-web