Bug 2000000
| Summary: | too many usbguard messages in the journal | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Milos Malik <mmalik> | |
| Component: | usbguard | Assignee: | Zoltan Fridrich <zfridric> | |
| Status: | CLOSED ERRATA | QA Contact: | Dalibor Pospíšil <dapospis> | |
| Severity: | medium | Docs Contact: | Mirek Jahoda <mjahoda> | |
| Priority: | medium | |||
| Version: | 8.5 | CC: | alakatos, dapospis, jvanek, mjahoda, rsroka, ymankad, zfridric | |
| Target Milestone: | rc | Keywords: | Triaged | |
| Target Release: | --- | |||
| Hardware: | x86_64 | |||
| OS: | Linux | |||
| Whiteboard: | ||||
| Fixed In Version: | usbguard-1.0.0-3.el8 | Doc Type: | Bug Fix | |
| Doc Text: |
.`usbguard-notifier` no longer logs too many error messages to the Journal
Previously, the `usbguard-notifier` service did not have inter-process communication (IPC) permissions for connecting to the `usbguard-daemon` IPC interface. Consequently, `usbguard-notifier` failed to connect to the interface, and it wrote a corresponding error message to the Journal. Because `usbguard-notifier` started with the `--wait` option, which ensured that `usbguard-notifier` attempted to connect to the IPC interface each second after a connection failure, by default, the log contained an excessive amount of these messages.
With this update, `usbguard-notifier` does not start with `--wait` by default. The service attempts to connect to the daemon only three times in the 1-second intervals. As a result, the log contains three such error messages at maximum.
|
Story Points: | --- | |
| Clone Of: | ||||
| : | 2009226 (view as bug list) | Environment: | ||
| Last Closed: | 2022-05-10 13:36:46 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 1969483, 2009226 | |||
|
Description
Milos Malik
2021-09-01 07:30:13 UTC
These messages appear every second. All 3 usbguard* services are running, but usbguard-notifier still complains:
# service usbguard status
Redirecting to /bin/systemctl status usbguard.service
● usbguard.service - USBGuard daemon
Loaded: loaded (/usr/lib/systemd/system/usbguard.service; enabled; vendor preset: disabled)
Active: active (running) since Wed 2021-09-01 09:22:15 CEST; 10min ago
Docs: man:usbguard-daemon(8)
Process: 7236 ExecStart=/usr/sbin/usbguard-daemon -f -s -c /etc/usbguard/usbguard-daemon.conf (code=exited, status=0/SUCCESS)
Main PID: 7238 (usbguard-daemon)
Tasks: 3 (limit: 11391)
Memory: 10.4M
CGroup: /system.slice/usbguard.service
└─7238 /usr/sbin/usbguard-daemon -f -s -c /etc/usbguard/usbguard-daemon.conf
Sep 01 09:32:45 localhost.localdomain usbguard-daemon[7238]: IPC connection denied: uid=42 gid=42 pid=2310
Sep 01 09:32:46 localhost.localdomain usbguard-daemon[7238]: IPC connection denied: uid=42 gid=42 pid=2310
Sep 01 09:32:47 localhost.localdomain usbguard-daemon[7238]: IPC connection denied: uid=42 gid=42 pid=2310
Sep 01 09:32:48 localhost.localdomain usbguard-daemon[7238]: IPC connection denied: uid=42 gid=42 pid=2310
Sep 01 09:32:49 localhost.localdomain usbguard-daemon[7238]: IPC connection denied: uid=42 gid=42 pid=2310
Sep 01 09:32:50 localhost.localdomain usbguard-daemon[7238]: IPC connection denied: uid=42 gid=42 pid=2310
Sep 01 09:32:51 localhost.localdomain usbguard-daemon[7238]: IPC connection denied: uid=42 gid=42 pid=2310
Sep 01 09:32:52 localhost.localdomain usbguard-daemon[7238]: IPC connection denied: uid=42 gid=42 pid=2310
Sep 01 09:32:53 localhost.localdomain usbguard-daemon[7238]: IPC connection denied: uid=42 gid=42 pid=2310
Sep 01 09:32:54 localhost.localdomain usbguard-daemon[7238]: IPC connection denied: uid=42 gid=42 pid=2310
# service usbguard-dbus status
Redirecting to /bin/systemctl status usbguard-dbus.service
● usbguard-dbus.service - USBGuard D-Bus Service
Loaded: loaded (/usr/lib/systemd/system/usbguard-dbus.service; enabled; vendor preset: disabled)
Active: active (running) since Wed 2021-09-01 09:22:15 CEST; 10min ago
Docs: man:usbguard-dbus(8)
Main PID: 7228 (usbguard-dbus)
Tasks: 4 (limit: 11391)
Memory: 1.8M
CGroup: /system.slice/usbguard-dbus.service
└─7228 /usr/sbin/usbguard-dbus --system
Sep 01 09:22:15 localhost.localdomain systemd[1]: Starting USBGuard D-Bus Service...
Sep 01 09:22:15 localhost.localdomain systemd[1]: Started USBGuard D-Bus Service.
# systemctl --user status usbguard-notifier
● usbguard-notifier.service - USBGuard Notifier
Loaded: loaded (/usr/lib/systemd/user/usbguard-notifier.service; enabled; vendor preset: enabled)
Active: active (running) since Wed 2021-09-01 09:17:11 CEST; 15min ago
Main PID: 5322 (usbguard-notifi)
Tasks: 2 (limit: 11391)
Memory: 2.1M
CGroup: /user.slice/user-0.slice/user/usbguard-notifier.service
└─5322 /usr/bin/usbguard-notifier -w
Sep 01 09:17:11 localhost.localdomain systemd[5302]: Started USBGuard Notifier.
Sep 01 09:17:11 localhost.localdomain usbguard-notifier[5322]: Connection has been established
Sep 01 09:22:15 localhost.localdomain usbguard-notifier[5322]: IPC connection failure!IPC connect: service=usbguard: Connection reset by peer
Sep 01 09:22:15 localhost.localdomain usbguard-notifier[5322]: Check if usbguard-daemon is running in the background
Sep 01 09:22:16 localhost.localdomain usbguard-notifier[5322]: Connection has been established
#
# grep -Ri ipc /etc/usbguard/ /etc/usbguard/usbguard-daemon.conf:# IPC interface. /etc/usbguard/usbguard-daemon.conf:# IPC interface. Usually, we set the option to /etc/usbguard/usbguard-daemon.conf:#!!! the daemon will accept IPC connections from !!! /etc/usbguard/usbguard-daemon.conf:# Users allowed to use the IPC interface. /etc/usbguard/usbguard-daemon.conf:# accept IPC connections from. /etc/usbguard/usbguard-daemon.conf:# IPCAllowedUsers=username1 username2 ... /etc/usbguard/usbguard-daemon.conf:IPCAllowedUsers=root /etc/usbguard/usbguard-daemon.conf:# Groups allowed to use the IPC interface. /etc/usbguard/usbguard-daemon.conf:# accept IPC connections from. /etc/usbguard/usbguard-daemon.conf:# IPCAllowedGroups=groupname1 groupname2 ... /etc/usbguard/usbguard-daemon.conf:IPCAllowedGroups=wheel /etc/usbguard/usbguard-daemon.conf:# IPC access control definition files path. /etc/usbguard/usbguard-daemon.conf:# This way each file defines who is able to connect to the IPC /etc/usbguard/usbguard-daemon.conf:IPCAccessControlFiles=/etc/usbguard/IPCAccessControl.d/ # # journalctl -u usbguard -S today | grep 'IPC connection denied' | wc -l 2212 # journalctl -S today | grep usbguard-notifier | grep 'IPC connection failure' | wc -l 2214 # Because we ship the usbguard and gdm packages by default, I believe that usbguard configuration should be modified to avoid spamming of the journal. Reproducible in 1MT on RHEL-8.4 too. A longer reproducer: 0) get a clean RHEL-8.5 machine 1) yum -y groupinstall "Server with GUI" 2) yum -y install usbguard\* 3) systemctl set-default graphical 4) systemctl enable usbguard 5) systemctl enable usbguard-dbus 6) reboot 7) journalctl -S today -u usbguard | grep 'IPC connection denied' happy 2*10^6 ! ●●●█〓〓██████████▅▄▄▄▄▄▄▄▃▃▃▃▄ ▄██ 〓 █CONGRATULATION█ 〓 ██▄ ▄▅█████████████████████████▅▄▃ █████████████████████████████◤ ◥⊙▲⊙▲⊙▲⊙▲⊙▲⊙▲⊙▲⊙▲⊙▲⊙▲⊙▲⊙▲⊙▲⊙▲◤ Sorry for spam! Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (usbguard bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2022:1779 |