Bugtraq mailing list archives
Re: local users can panic linux kernel (was: SuSE syslogd
From: saw () MSU RU (Savochkin Andrey Vladimirovich)
Date: Tue, 23 Nov 1999 12:58:06 +0300
Alan, On Mon, Nov 22, 1999 at 09:32:38PM +0000, Alan Cox wrote:
It isn't clear for me what can be done to protect the whole system inside syslogd. Does anybody knows what SuSE really changed? Their source package isn't very helpful.There were two notable problems 1. Syslogd defaulted to stream sockets which means you have resource control problems - in fact Dan Bernstein posted some very good stuff about that issue about a year ago 2. The client code decided it would be a good idea to wait - ie do a blocking connect. Unfortunate it someone ate all the syslog handles With a datagram system it comes down to losing messages under load. I think that is about as good as you can get.
Thank you for your points. I think that replacing stream sockets by datagram is a step in a wrong direction. Datagram sockets are not only unreliable by definition. Their use makes completely impossible for applications to check if their message has been properly logged or no. Stream sockets allows at least catch some cases when the message is lost. The fact that libc provides syslog functions that return only void makes result checking not so easy. But people may have their own libraries for system logging which don't suffer from the problem. It's clear that there are some resource control problems with connection oriented sockets. These resource control problems may block logging under certain conditions. But I don't think that these problems are unsolvable. As a first step we may consider creating several unix sockets for different facilities and some access control. So it looks wrong for me to refuse attempts to solve the problems, drop some existing code, and finally stop at intrinsicly unreliable solution. Best regards Andrey V. Savochkin
Current thread:
- Pandora v4 Beta 2 Software, (continued)
- Pandora v4 Beta 2 Software Simple Nomad (Nov 19)
- Remote D.o.S Attack in G6 FTP Server v2.0 (beta 4/5) Vulnerability Ussr Labs (Nov 16)
- Re: Remote D.o.S Attack in G6 FTP Server v2.0 (beta 4/5) Vulnerability Seth R Arnold (Nov 17)
- Re: Remote D.o.S Attack in G6 FTP Server v2.0 (beta 4/5) Vulnerability Marc (Nov 17)
- SuSE Security Announcement - syslogd (a1) Thomas Biege (Nov 18)
- local users can panic linux kernel (was: SuSE syslogd advisory) Mixter (Nov 18)
- Re: local users can panic linux kernel (was: SuSE syslogd advisory) Alan Cox (Nov 19)
- Re: local users can panic linux kernel (was: SuSE syslogd advisory) Savochkin Andrey Vladimirovich (Nov 20)
- ANN: Bruce v1.0 Early Access 1 - Available for downloa Alec Muffett (Nov 22)
- Re: local users can panic linux kernel (was: SuSE syslogd Alan Cox (Nov 22)
- Re: local users can panic linux kernel (was: SuSE syslogd Savochkin Andrey Vladimirovich (Nov 23)
- Re: local users can panic linux kernel (was: SuSE syslogd Darren Reed (Nov 23)
- Re: local users can panic linux kernel (was: SuSE syslogd Savochkin Andrey Vladimirovich (Nov 24)
- Remote DoS Attack in WorldClient Server v2.0.0.0 Vulnerability Ussr Labs (Nov 24)
- Remote DoS Attack in BisonWare FTP Server V3.5 Vulnerability Ussr Labs (Nov 24)
- Re: local users can panic linux kernel (was: SuSE syslogd Darren Reed (Nov 24)
- [w00giving '99 #5 and w00news]: UnixWare 7's su Matt Conover (Nov 25)
- Buffer Overflow Survey Paper Crispin Cowan (Nov 22)
- Operational Issues: Applications & Appliances (was: Buffer Overflow Survey Paper) Crispin Cowan (Nov 23)
- [ COBALT ] Security Advisory - Sendmail Jeff Bilicki (Nov 24)
- Re: Operational Issues: Applications & Appliances (was: Buffer Overflow Survey Paper) Scott Zimmerman (Nov 24)