-
Bug
-
Resolution: Done-Errata
-
Undefined
-
rhel-9.2.0
-
rsyslog-8.2310.0-3.el9
-
None
-
Moderate
-
rhel-sst-security-special-projects
-
ssg_security
-
None
-
QE ack, Dev ack
-
False
-
-
Yes
-
None
-
Bug Fix
-
-
Done
-
-
x86_64
-
None
Hi:
We have a rsyslog omprog script which is working fine under RHEL7/8. we tried it under RHEL 9.2/9.3 stream but it failed to load. we tried to figure why and found omprog is sensitive about script owner/permissions. my example rsyslog files are below:
============
>cat /etc/rsyslog.d/example.conf
module(load="omprog")
. action(type="omprog" binary="/usr/bin/a.sh")
>cat /usr/bin/a.sh
#!/usr/bin/bash
while true;do
sleep 1
done
>ls -la /usr/bin/a.sh
rwx----- 1 bin bin 45 Aug 26 23:36 /usr/bin/a.sh
============
The rsyslog error messages are below:
Aug 26 23:40:39 test.example.com rsyslogd[1691]: child process (pid 1695) exited with status 126 [v8.2102.0-117.el9]
Aug 26 23:40:39 test.example.com rsyslogd[1691]: omprog: program '/usr/bin/a.sh' (pid 1695) terminated; will be restarted [v8.2102.0-117.el9 try https://www.rsyslog.com/e/2119 ]
Aug 26 23:40:39 test.example.com rsyslogd[1691]: action 'action-0-omprog' suspended (module 'omprog'), retry 0. There should be messages before this one giving the reason for suspension. [v8.2102.0-117.el9 try https://www.rsyslog.com/e/2007 ]
Aug 26 23:40:40 test.example.com postfix/smtpd[1707]: disconnect from unknown[95.214.26.184] ehlo=1 auth=0/1 quit=1 commands=2/3
Aug 26 23:40:40 test.example.com rsyslogd[1691]: action 'action-0-omprog' resumed (module 'omprog') [v8.2102.0-117.el9 try https://www.rsyslog.com/e/2359 ]
The workaround is easy. if we "chown root.root a.sh" or "chmod 755 a.sh" then rsyslog is happy loading the script. we have tried rsyslog version "8.2102.0-113" and "8.2102.0-117" (comes from stream) under RHEL 9.2.
- external trackers
- links to
-
RHBA-2023:124274 rsyslog bug fix and enhancement update