Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1263727

Bug#1116595: Packaging issue: xfs_scrub_all_fail.service NoNewPrivileges breaks emailing reports

Show all headers | View raw

Package: xfsprogs
Version: 6.13.0-2+b1
Severity: important
X-Debbugs-Cc: iustin@debian.org

I've struggled with this for a while because all my logs were spammed by
hundreds of lines of:

postfix/postdrop[37291]: warning: mail_queue_enter: create file maildrop/480926.37291: Permission denied

And it took me a long while to dig this down to xfs_scrub reporting.
Problem setup:

- mailer is postfix, which uses a setgid /usr/sbin/postdrop binary to
  write to /var/lib/postfix/maildrop (mode 0730, group postdrop)
- the systemd unit for the xfs_scrub reporting,
  /usr/lib/systemd/system/xfs_scrub_all_fail.service, contains:
  
  # xfs_scrub needs these privileges to run, and no others
  CapabilityBoundingSet=
  NoNewPrivileges=true

Together, this means that the script
(/usr/libexec/xfsprogs/xfs_scrub_fail) composes the email, and pipes it
to "/usr/sbin/sendmail -t -i", which in turn invokes the postdrop
binary, but which can't get the sgid bit. But since it calls sendmail
repeatedly, I get for a few days, every hour, hundreds of flagged log
entries by logcheck.

Now, the Trixie kernel seems to not support scrubbing anyway, so I can
simply disable this, but it would be better to fix this and do an update
(in trixe), otherwise the log spamming is really annoying.

Thanks!

-- System Information:
Debian Release: 13.1
  APT prefers stable
  APT policy: (990, 'stable'), (500, 'stable-updates'), (500, 'stable-security')
Architecture: amd64 (x86_64)

Kernel: Linux 6.12.43+deb13-amd64 (SMP w/4 CPU threads; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) (ignored: LC_ALL set to en_US.UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages xfsprogs depends on:
ii  libblkid1           2.41-5
ii  libc6               2.41-12
ii  libdevmapper1.02.1  2:1.02.205-2
ii  libedit2            3.1-20250104-1
ii  libicu76            76.1-4
ii  libinih1            59-1
ii  liburcu8t64         0.15.2-2
ii  libuuid1            2.41-5
ii  python3             3.13.5-1
ii  python3-dbus        1.4.0-1

xfsprogs recommends no packages.

Versions of packages xfsprogs suggests:
ii  acl      2.3.2-2+b1
ii  attr     1:2.5.2-3
ii  quota    4.09-1+b1
ii  xfsdump  3.2.0-2

-- no debconf information

Back to linux.debian.bugs.dist | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#1116595: Packaging issue: xfs_scrub_all_fail.service NoNewPrivileges breaks emailing reports Iustin Pop <iustin@debian.org> - 2025-09-29 00:00 +0200
  Bug#1116595: Packaging issue: xfs_scrub_all_fail.service NoNewPrivileges breaks emailing reports "Darrick J. Wong" <djwong@kernel.org> - 2025-10-13 20:00 +0200
    Bug#1116595: Packaging issue: xfs_scrub_all_fail.service NoNewPrivileges breaks emailing reports Iustin Pop <iustin@debian.org> - 2025-10-13 22:20 +0200
      Bug#1116595: Packaging issue: xfs_scrub_all_fail.service NoNewPrivileges breaks emailing reports "Darrick J. Wong" <djwong@kernel.org> - 2025-10-14 00:40 +0200
        Bug#1116595: Packaging issue: xfs_scrub_all_fail.service NoNewPrivileges breaks emailing reports "Darrick J. Wong" <djwong@kernel.org> - 2025-10-14 01:40 +0200
  Bug#1116595: [PATCH] xfs_scrub_fail: reduce security lockdowns to avoid postfix problems "Darrick J. Wong" <djwong@kernel.org> - 2025-10-14 01:40 +0200

csiph-web