Bug#923137: chrony: system call filter (now enabled by default) conflicts not only with mailonchange, but also with log

[Vincent Blut]

On Sun, Feb 24, 2019 at 05:05:58PM +0100, Francesco Poli wrote:

On Sun, 24 Feb 2019 16:25:19 +0100 Vincent Blut wrote:

[...]

On Sun, Feb 24, 2019 at 12:59:21PM +0100, Francesco Poli (wintermute)
wrote:

[...]

>Everything seems to be fine, but:
>
>  $ ps a | grep chrony
>  10686 pts/1    S+     0:00 grep chrony
>
>the daemon is not running!

Could you please provide the output of `grep -i chrony /var/log/syslog'?

The lines added when doing

 # service chrony start

are:

 Feb 24 16:53:39 HOST chronyd[11063]: chronyd version 3.4 starting (+CMDMON 
+NTP +REFCLOCK +RTC +PRIVDROP +SCFILTER +SIGND +ASYNCDNS +SECHASH +IPV6 -DEBUG)
 Feb 24 16:53:39 HOST chronyd[11063]: Frequency -63.017 +/- 0.053 ppm read from 
/var/lib/chrony/chrony.drift
 Feb 24 16:53:39 HOST chronyd[11063]: Loaded seccomp filter

But, once again, chrony is not running:

 # ps a | grep chrony
 11086 pts/0    S+     0:00 grep chrony

Please use `ps ax | grep chrony' (or ps -ef). `ps a' only lists processes with a tty. Also, the output of `chronyc tracking' would be useful to check chronyd’s status and system time information.

>After a bit of investigation, I found out that the log directive:

>
>  $ grep '^log ' /etc/chrony/chrony.conf
>  log tracking measurements statistics
>
>seems to also conflict with the system call filter.

That is not supposed to happen. I’m running some systems with chronyd’s
log files and the system call filter enabled with no issues. Could you
tell me more about the “logdir” directive in /etc/chrony/chrony.conf?

 $ grep logdir /etc/chrony/chrony.conf
 logdir /var/log/chrony
 $ ls -altrF /var/log/chrony
 total 44
 drwxr-xr-x  2 _chrony _chrony  4096 Feb 24 10:31 ./
 drwxr-xr-x 10 root    root     4096 Feb 24 11:09 ../
 -rw-r--r--  1 _chrony _chrony 12051 Feb 24 16:51 statistics.log
 -rw-r--r--  1 _chrony _chrony 16029 Feb 24 16:51 measurements.log
 -rw-r--r--  1 _chrony _chrony  6336 Feb 24 16:53 tracking.log

Needless to say, the logs were written by chronyd, when running with
the '-F 0' option...

# mv /var/log/chrony/measurements.log /var/log/chrony/measurements1.log
# chronyc cyclelogs



Cheers,
Vincent

Ok, so please reenable the syscall filter and run the following commands (as root): wait a few seconds and tell me if a new “measurements.log” file is created.

signature.asc
Description: PGP signature