[Bug 1725351] Re: Systemd - Remote DOS of systemd-resolve service

2018-02-07 Thread David Glasser
Thanks Marc! Do you happen to know the answer to my other question? "I'm also not an expert on NSEC/DNSSEC. Is this something that any random app that uses DNS can be vulnerable too, or does it require a program to specifically be trying to invoke DNSSEC somehow?" -- You received this bug notifi

[Bug 1725351] Re: Systemd - Remote DOS of systemd-resolve service

2018-02-05 Thread David Glasser
@mdeslaur: Should I interpret the release of https://usn.ubuntu.com/usn/usn-3558-1/ as saying that the answer to my question in comment 19 is that yes, now we are getting the response? -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. ht

[Bug 1741934] Re: Kernel trace with xenial 4.4 (4.4.0-108.131, Candidate kernels for PTI fix)

2018-01-10 Thread David Glasser
Does anyone know if this issue affects linux-aws, which was not mentioned in the USN? -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1741934 Title: Kernel trace with xenial 4.4 (4.4.0-108.131, Candi

[Bug 1732803] Re: systemd-journald RateLimitBurst is sometimes divided by 4

2017-11-21 Thread David Glasser
I got some advice on mistakes in my update to changelog. This version should be better. ** Patch added: "Second version with fixed changelog entries" https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1732803/+attachment/5012529/+files/Fix-journald-rate-limit-with-low-disk-space.debdiff -

[Bug 1732803] Re: systemd-journald RateLimitBurst is sometimes divided by 4

2017-11-21 Thread David Glasser
This is my first attempt at a debdiff and an SRU. I'd love to know if I've filed it properly! -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1732803 Title: systemd-journald RateLimitBurst is sometime

[Bug 1732803] Re: systemd-journald RateLimitBurst is sometimes divided by 4

2017-11-16 Thread David Glasser
Correction: I believe this occurs when the amount of remaining space until journald hits its allocated limit is between 1 and 16MB, not when the entire filesystem has that little space left. (This makes it much more likely to occur: any system that is using logs enough for them to be rotated due t

[Bug 1732803] [NEW] systemd-journald RateLimitBurst is sometimes divided by 4

2017-11-16 Thread David Glasser
Public bug reported: [Impact] systemd-journald allows you to configure a per-service journal rate limit in /etc/systemd/journald.conf via the RateLimitBurst parameter. systemd-journald has code that effectively increases the rate limit when there is a lot of disk space available. However, all

[Bug 1732803] Re: systemd-journald RateLimitBurst is sometimes divided by 4

2017-11-16 Thread David Glasser
** Patch added: "debdiff backporting fix from upstream" https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1732803/+attachment/5010237/+files/Fix-journald-rate-limit-with-low-disk-space.debdiff -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscri

[Bug 1725351] Re: Systemd - Remote DOS of systemd-resolve service

2017-10-26 Thread David Glasser
We manually enable systemd-resolved.service on xenial. It's installed though it is not the default. Does that mean we are not going to get the fix for this? I'm also not an expert on NSEC/DNSSEC. Is this something that any random app that uses DNS can be vulnerable too, or does it require a progr

[Bug 1719851] Re: ca-certificates isn't updated in LTS 16.04

2017-10-03 Thread David Glasser
I just saw this via the USN. I'm having trouble evaluating the urgency of this fix. Is the issue: - Without this, connecting to some sites will fail because of missing/lapsed CAs or - Without this, you'll probably get MITMed because you're trusting some insecure hacked CAs ? -- You received

[Bug 1655842] Re: "Out of memory" errors after upgrade to 4.4.0-59

2017-02-09 Thread David Glasser
To be fair, there have been multiple USN-reported kernel security patches fixed in post-57 kernels. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1655842 Title: "Out of memory" errors after upgrade

[Bug 1655842] Re: "Out of memory" errors after upgrade to 4.4.0-59

2017-02-09 Thread David Glasser
Cascardo: Just to be clear, are you looking for verification from anyone in the world, or from specific kernel testers? (I'd like to help, but I'm only able to reproduce the issue in production, and the process of debugging this issue when we ran into it was already more restarts than is good for

[Bug 1655842] Re: "Out of memory" errors after upgrade to 4.4.0-59

2017-02-09 Thread David Glasser
kulwinder singh: Either one, but nothing in between. -57 will reintroduce a few (unrelated) security bugs as well as the bug https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1647400 whose fix caused this one, but is easier to enable and has been tested for longer. -63 should fix this bug, the

[Bug 1655842] Re: "Out of memory" errors after upgrade to 4.4.0-59

2017-02-06 Thread David Glasser
I've been struggling with this bug for nearly a week and only now found this issue. Thanks for fixing it! For the sake of others finding it, here's the stack trace part of the oom-killer log, which contains some terms I searched for a while ago that aren't mentioned here yet. docker invoked oom-

[Bug 1636912] Re: systemd-networkd runs too late for cloud-init.service (net)

2016-11-29 Thread David Glasser
Hi. This issue affected us on Xenial; we explicitly enable systemd- networkd on our images (when creating our AMI), and after a recent AMI rebuild we were no longer able to start our AMIs. When I looked at the system console we saw things that looked like: [ 52.866176] cloud-init[721]: Cloud-in