Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1226146

Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles

Show all headers | View raw

On Sat, 28 Dec 2024 21:15:34 +0000 Richard Lewis
<richard.lewis.debian@googlemail.com> wrote:
> On Sun, 15 Dec 2024 22:40:51 +0000 Julian Gilbey <jdg@debian.org> wrote:
> > On Wed, Dec 11, 2024 at 11:43:18PM +0000, Richard Lewis wrote:
> > > [...]
> > > I think all it needs is
> > > /etc/systemd/system/chkrootkit.service.d/override.conf with
> > >
> > > [Service]
> > > ProtectSystem=strict
> > >
> > > (you can do "systemctl edit chkrootkit.service" and it will make such
> > > a file and reload it,
> > > you can then do systemctl start chkrootkit and it should be used)
> > > That should solve the problem for the daily check. Can you see if that
> > > it works. it's probably useful anyway)
> >
> > That works perfectly, thank you!
>
> Quick update: I've been testing this, and whille it usually works it
> can prevent the output being emailed with the following:
>
> Dec 28 00:01:45 hostname chkrootkit-daily[4050677]: mail:
> mu_temp_file_stream_create() failed: Read-only file system
> Dec 28 00:01:45 hostname chkrootkit-daily[4050677]: mail:
> mu_temp_file_stream_create() failed: Read-only file system
> Dec 28 00:01:46 hostname exim[4050709]: 2024-12-28 00:01:46
> 1tRKH4-00Gzm1-00 Failed to create spool file
> /var/spool/exim4//input//1tRKH4-00Gzm1-00-D: Read-only file system
> Dec 28 00:01:46 hostname exim[4050709]: 2024-12-28 00:01:46
> 1tRKH4-00Gzm1-00 Cannot open main log file "/var/log/exim4/mainlog":
> Permission denied: euid=109 egid=113
> Dec 28 00:01:46 hostname exim[4050709]: exim: could not open panic log
> - aborting: see message(s) above
>
> I believe this only(?) happens if the report is large enough. i assume
> we can allow more of /var to be read-write and avoid this
> possibly the first error is from mailutils -- i remember failing to
> identify this before, unfortunately without success.

I believe the following is needed in override.conf -- this allows exim
to write its logs and send the final email, and mailutils (and others)
to have /run/chkrootkit as a writeable TMPDIR while the real /tmp
stays "protected". (this last is needed if mail is provided by
mailutils, and is sensible anyway)


[Service]
ProtectSystem=strict
ReadWritePaths=-/var/spool -/var/mail -/var/log
RuntimeDirectory=chkrootkit
Environment=TMPDIR=/run/chkrootkit

Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles Julian Gilbey <jdg@debian.org> - 2024-12-09 13:50 +0100
  Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles Richard Lewis <richard.lewis.debian@googlemail.com> - 2024-12-09 23:50 +0100
    Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles Julian Gilbey <jdg@debian.org> - 2024-12-10 10:20 +0100
      Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles Richard Lewis <richard.lewis.debian@googlemail.com> - 2024-12-10 14:20 +0100
        Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles Julian Gilbey <jdg@debian.org> - 2024-12-11 17:00 +0100
          Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles Richard Lewis <richard.lewis.debian@googlemail.com> - 2024-12-12 00:50 +0100
            Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles Julian Gilbey <jdg@debian.org> - 2024-12-15 23:50 +0100
  Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles Richard Lewis <richard.lewis.debian@googlemail.com> - 2024-12-28 22:20 +0100
  Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles Richard Lewis <richard.lewis.debian@googlemail.com> - 2024-12-30 14:20 +0100

csiph-web