Bug 2076267

Summary: sysctl --system disables abrt-hook-ccpp
Product: Red Hat Enterprise Linux 8 Reporter: Paulo Andrade <pandrade>
Component: abrtAssignee: abrt <abrt-devel-list>
Status: CLOSED WONTFIX QA Contact: CS System Management SST QE <rhel-cs-system-management-subsystem-qe>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 8.1CC: dtardon, msekleta, ovasik, systemd-maint-list
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2023-06-30 08:18:08 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Paulo Andrade 2022-04-18 13:45:58 UTC 
When configuring the system to use abrt-ccpp instead of systemd-coredump,
if running "sysctl --system", it will override kernel.core_pattern

To reproduce the issue, assuming it is using systemd-coredump, what
should be default, run:


# systemctl disable abrt-journal-core.service
# systemctl mask abrt-journal-core.service
# systemctl stop abrt-journal-core.service
# systemctl enable abrt-ccpp.service
# systemctl start abrt-ccpp.service

  After above steps, might need to run:

# systemctl daemon-reload

or reboot.

After that /proc/sys/kernel/core_pattern should show it is using
abrt-hook-ccpp.

The problem is that if running "sysctl --system" will change back to
use systemd-coredump, leaving the system in a confusing state.


It should be possible to use abrt-ccpp instead of systemd-coredump
and also be able to run "sysctl --system", without any hacking around
to save/restore /proc/sys/kernel/core_pattern
Comment 1 Michal Sekletar 2022-04-19 13:02:03 UTC 
I think it should be ABRT package that will ship/create sysctl snippet that would override the default one.
Comment 2 David Tardon 2022-04-19 17:17:01 UTC 
To expand comment 1 a bit: the way abrt sets up kernel.core_pattern is just incompatible with `sysctl --system`. abrt-ccpp.service changes the core_pattern on the fly, on start/stop of the service, but sysctl configuration *on disk* remains unchanged. Hence, when `sysctl --system` is run, it just reapplies that configuration, overriding the value previously written by abrt-ccpp.service. There are two simple ways to fix this: 1/ Ship a config. file for sysctl that overrides the kernel.core_pattern set by systemd's config. file (which is /usr/lib/sysctl.d/50-coredump.conf, so something like /usr/lib/sysctl.d/60-abrt.conf would do.) Then kernel.core pattern would be set to abrt just by installing abrt (or a subpackage of abrt that contains the C++ hook). 2/ Also write the core_pattern to a temporary config. file in /run/sysctl.d on start of abrt-ccpp.service (and remove the file again on stop).