Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-19787

[RHEL 8/systemd/BUG] journald: when SplitMode=uid is set on persistent storage an unprivileged user can prune other users logs and the system journal logs by filling its own journal due to automatic rotation of all journals at the same time..

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Normal Normal
    • None
    • rhel-8.9.0
    • systemd
    • None
    • Critical
    • rhel-sst-cs-plumbers
    • ssg_core_services
    • 3
    • False
    • Hide

      None

      Show
      None
    • None
    • Red Hat Enterprise Linux
    • None
    • None
    • None
    • All
    • None

      What were you trying to do that didn't work?

      Have each journal file to be rotated only when its size+time limit is reached, and not when another user's journal reaches a size limit.

      This can cause all events from other users or even the system to be pruned via automatic rotation of journals.

      Please provide the package NVR for which bug is seen:

      systemd-239-78.el8.x86_64, maybe other versions as well

      How reproducible:

      Always

      Steps to reproduce

      1. Create a configuration drop-in
        1. # mkdir -p /etc/systemd/journald.conf.d/
        2. # vi /etc/systemd/journald.conf.d/journald.conf
        3. [Journal]
          Storage=persistent
          SplitMode=uid
          RateLimitBurst=0
      2. Restart systemd-journald
        1. # systemctl restart systemd-journald.service
      3. Log in to the system as an unpriviledged user and generate a exaggerated amount of log records (to reproduce it faster)
        1. # ssh user@localhost
        2. $ id user
          uid=1000(user) gid=1000(user) groups=1000(user)
        3. $ while true; do head -c 512 /dev/urandom | base64 | logger; done

      Expected results

       

      Only user-1000@*.journal files to be rotated when its journal file reaches the defined/default size limit.

      Actual results

      All journals files gets rotated whenever the user-1000 (user) reaches the size limit on any single journal file.

              systemd-maint systemd maint mailing list
              rhn-support-jgamba Juan Gamba
              systemd maint mailing list systemd maint mailing list
              Frantisek Sumsal Frantisek Sumsal
              Votes:
              1 Vote for this issue
              Watchers:
              8 Start watching this issue

                Created:
                Updated: