Bug 1843994

This bug was initially created as a copy of Bug #1843992

I am copying this bug because: 

Same code.


Description of problem:

When rsyslog is configured to read from imfile located on a directory referred as a symlink and labeled with var_t, rsyslog dies with following backtrace:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
Program terminated with signal 11, Segmentation fault.
#0  0x00007efdca236cd7 in process_symlink (chld=chld@entry=0x563611ba6030, 
    symlink=symlink@entry=0x7efdb00022c0 "/var/log/myplace_symlink") at imfile.c:710
710			uint idx = ustrlen(chld->active->name) - ustrlen(chld->active->basename);


#0  0x00007efdca236cd7 in process_symlink (chld=chld@entry=0x563611ba6030, 
    symlink=symlink@entry=0x7efdb00022c0 "/var/log/myplace_symlink") at imfile.c:710
#1  0x00007efdca2370cb in poll_tree (chld=0x563611ba6030) at imfile.c:754
#2  0x00007efdca23284d in fs_node_walk (node=<optimized out>, 
    f_usr=f_usr@entry=0x7efdca236e60 <poll_tree>) at imfile.c:957
#3  0x00007efdca232859 in fs_node_walk (node=<optimized out>, 
    f_usr=f_usr@entry=0x7efdca236e60 <poll_tree>) at imfile.c:958
#4  0x00007efdca232859 in fs_node_walk (node=<optimized out>, 
    f_usr=f_usr@entry=0x7efdca236e60 <poll_tree>) at imfile.c:958
#5  0x00007efdca232859 in fs_node_walk (node=<optimized out>, 
    f_usr=f_usr@entry=0x7efdca236e60 <poll_tree>) at imfile.c:958
#6  0x00007efdca236591 in doPolling () at imfile.c:1925
#7  runInput (pThrd=<optimized out>) at imfile.c:2152
#8  0x0000563610eb74f4 in thrdStarter (arg=0x563611baf0a0) at ../threads.c:226
#9  0x00007efdcdd8fea5 in start_thread (arg=0x7efdbe22d700) at pthread_create.c:307
#10 0x00007efdcce838dd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

This is due to act_obj_add() function returning no error but not setting chld->active pointer, leading to a NULL pointer dereference (chld->active->name)


Version-Release number of selected component (if applicable):

rsyslog-8.24.0-52.el7.x86_64 and later


How reproducible:

Always


Steps to Reproduce:
1. Create a imfile path with top directory being a symlink

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
# mkdir -p /var/my/place
# ln -s /var/my/place /var/log/myplace_symlink

# ls -Zd /var/my/place /var/log/myplace_symlink
lrwxrwxrwx. root root unconfined_u:object_r:var_log_t:s0 /var/log/myplace_symlink -> /var/my/place
drwxr-xr-x. root root unconfined_u:object_r:var_t:s0   /var/my/place
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------


2. Create imfile snippet

rsyslog imfile configuration (/etc/rsyslog.d/imfile.conf):
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
module(load="imfile" PollingInterval="10")

input(type="imfile"
      file="/var/log/myplace_symlink/file.log"
      tag="myplace_file"
      severity="info"
      facility="local5"
)
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------


3. Start rsyslog

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
# systemctl restart rsyslog

# systemctl status rsyslog
[...]
  Process: 5725 ExecStart=/usr/sbin/rsyslogd -n $SYSLOGD_OPTIONS (code=killed, signal=SEGV)
[...]
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------


Actual results:

Coredump

Expected results:

No coredump

Additional info:

Coredump analysis

We have act_obj_add() on line 708 called and returning a success, even though we entered "else" condition on line 576, which only prints a statement but doesn't make the function fail.

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
 694 static rsRetVal
 695 process_symlink(fs_edge_t *const chld, const char *symlink)
 696 {
 :
 708         if (act_obj_add(chld, target, is_file, fileInfo.st_ino, 0, symlink) == RS_RET_OK) {
 709                 /* need to watch parent target as well for proper rotation support */
 710                 uint idx = ustrlen(chld->active->name) - ustrlen(chld->active->basename);
 :
 725 finalize_it:
 726         free(target);
 727         RETiRet;
 728 }


 554 static rsRetVal
 555 act_obj_add(fs_edge_t *const edge, const char *const name, const int is_file,
 556         const ino_t ino, const int is_symlink, const char *const source)
 557 {
 :
 573         const int fd = open(name, O_RDONLY | O_CLOEXEC);
 574         if(fd < 0) {
 575                 if (is_file) { LogMsg(errno, RS_RET_ERR, LOG_WARNING, "imfile: error accessing file      '%s'", name);
 576                 } else { DBGPRINTF("imfile: error accessing file '%s'", name); }
 577                 FINALIZE;
 578         }
 :
 620 finalize_it:
 621         if(iRet != RS_RET_OK) {
 622                 if(act != NULL) {
 623                         free(act->name);
 624                         free(act);
 625                 }
 626         }
 627         RETiRet;
 628 }
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------


See also SELinux BZ #1823669