Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1776149

Summary:	Settings in /usr/lib/sysctl.d take precedence over settings in tuned profiles in /etc/tuned.
Product:	Red Hat Enterprise Linux 7	Reporter:	Jiří Mencák <jmencak>
Component:	tuned	Assignee:	Jaroslav Škarvada <jskarvad>
Status:	CLOSED ERRATA	QA Contact:	Robin Hack <rhack>
Severity:	medium	Docs Contact:	Mariya Pershina <mpershin>
Priority:	medium
Version:	7.7	CC:	jeder, josorior, jskarvad, mpershin, olysonek, qe-baseos-daemons, rhack, thozza
Target Milestone:	rc	Keywords:	AutoVerified, Patch, Triaged, Upstream
Target Release:	---	Flags:	thozza: mirror+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	tuned-2.11.0-9.el7	Doc Type:	Bug Fix
Doc Text:	.`tuned` no longer applies settings from `sysctl.d` directories when the `reapply_sysctl` option is set to `1` Previously, if the `reapply_sysctl` configuration option was set to `1`, the `tuned` profile applied `sysctl` settings from the `/usr/lib/sysctl.d`, `/lib/sysctl.d`, and `/usr/local/lib/sysctl.d` directories after applying `sysctl` settings from a `tuned` profile. Consequently, settings from these directories would override `sysctl` settings from the `tuned` profile. With this update, `tuned` no longer applies `sysctl` settings from the mentioned directories when the `reapply_sysctl` option is set to `1`. Note that to re-apply `sysctl` settings you need to move them from the mentioned directories to `/etc/sysctl.d`, `/etc/sysctl.conf` or `/run/sysctl.d` directories or to a custom `tuned` profile.	Story Points:	---
Clone Of:	1759597	Environment:
Last Closed:	2020-09-29 19:36:52 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1759597
Bug Blocks:	1757052, 1780577

Description Jiří Mencák 2019-11-25 08:52:55 UTC

+++ This bug was initially created as a clone of Bug #1759597 +++

Description of problem:
Tuned fails to set certain sysctls (e.g. kernel.yama.ptrace_scope).

Version-Release number of selected component (if applicable):
[root@b8 ~]# rpm -qi tuned
Name        : tuned
Version     : 2.12.0
Release     : 3.el8
Architecture: noarch
Install Date: Tue 08 Oct 2019 11:26:12 AM EDT
Group       : Unspecified
Size        : 732634
License     : GPLv2+
Signature   : RSA/SHA256, Fri 16 Aug 2019 01:11:51 PM EDT, Key ID 199e2f91fd431d51
Source RPM  : tuned-2.12.0-3.el8.src.rpm
Build Date  : Fri 16 Aug 2019 12:19:45 PM EDT
Build Host  : x86-vm-08.build.eng.bos.redhat.com
Relocations : (not relocatable)
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
Vendor      : Red Hat, Inc.
URL         : http://www.tuned-project.org/
Summary     : A dynamic adaptive system tuning daemon
Description :
The tuned package contains a daemon that tunes system settings dynamically.
It does so by monitoring the usage of several system components periodically.
Based on that information components will then be put into lower or higher
power saving modes to adapt to the current usage. Currently only ethernet
network and ATA harddisk devices are implemented.


How reproducible:
Always

Steps to Reproduce:
[root@b8 ~]# sysctl kernel.kptr_restrict
kernel.kptr_restrict = 0
[root@b8 ~]# sysctl kernel.yama.ptrace_scope
kernel.yama.ptrace_scope = 0

[root@b8 ~]# cat /etc/tuned/kernel-sec-cc/tuned.conf 
[main]
summary=A custom profile for kernel sysctl settings related to the CC profile

[sysctl]
kernel.kptr_restrict=1
#kernel.dmesg_restrict=1
#kernel.perf_event_paranoid=2
#kernel.kexec_load_disabled=1
kernel.yama.ptrace_scope=1

[root@b8 ~]# tuned --debug --no-dbus
...

2019-10-08 11:31:46,323 INFO     tuned.daemon.daemon: Using 'kernel-sec-cc' profile
2019-10-08 11:31:46,323 INFO     tuned.profiles.loader: loading profile: kernel-sec-cc
2019-10-08 11:31:46,324 INFO     tuned.daemon.controller: starting controller
2019-10-08 11:31:46,324 INFO     tuned.daemon.daemon: starting tuning
2019-10-08 11:31:46,324 DEBUG    tuned.plugins.repository: creating plugin sysctl
2019-10-08 11:31:46,325 DEBUG    tuned.utils.plugin_loader: loading module tuned.plugins.plugin_sysctl
2019-10-08 11:31:46,325 DEBUG    tuned.units.manager: creating 'sysctl' (sysctl)
2019-10-08 11:31:46,325 DEBUG    tuned.plugins.base: initializing instance sysctl (sysctl)
2019-10-08 11:31:46,325 DEBUG    tuned.hardware.inventory: starting monitor observer
2019-10-08 11:31:46,326 DEBUG    tuned.plugins.plugin_sysctl: Value of sysctl parameter 'kernel.kptr_restrict' is '0'
2019-10-08 11:31:46,326 DEBUG    tuned.plugins.plugin_sysctl: Setting sysctl parameter 'kernel.kptr_restrict' to '1'
2019-10-08 11:31:46,326 DEBUG    tuned.plugins.plugin_sysctl: Value of sysctl parameter 'kernel.yama.ptrace_scope' is '0'
2019-10-08 11:31:46,326 DEBUG    tuned.plugins.plugin_sysctl: Setting sysctl parameter 'kernel.yama.ptrace_scope' to '1'
2019-10-08 11:31:46,326 INFO     tuned.plugins.plugin_sysctl: reapplying system sysctl
2019-10-08 11:31:46,326 DEBUG    tuned.plugins.plugin_sysctl: Applying sysctl settings from file /usr/lib/sysctl.d/10-default-yama-scope.conf
2019-10-08 11:31:46,326 DEBUG    tuned.plugins.plugin_sysctl: Setting sysctl parameter 'kernel.yama.ptrace_scope' to '0'
2019-10-08 11:31:46,326 DEBUG    tuned.plugins.plugin_sysctl: Finished applying sysctl settings from file /usr/lib/sysctl.d/10-default-yama-scope.conf
2019-10-08 11:31:46,326 DEBUG    tuned.plugins.plugin_sysctl: Applying sysctl settings from file /usr/lib/sysctl.d/50-coredump.conf
2019-10-08 11:31:46,326 DEBUG    tuned.plugins.plugin_sysctl: Setting sysctl parameter 'kernel.core_pattern' to '|/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h %e'
2019-10-08 11:31:46,327 DEBUG    tuned.plugins.plugin_sysctl: Finished applying sysctl settings from file /usr/lib/sysctl.d/50-coredump.conf
2019-10-08 11:31:46,327 DEBUG    tuned.plugins.plugin_sysctl: Applying sysctl settings from file /usr/lib/sysctl.d/50-default.conf
2019-10-08 11:31:46,327 DEBUG    tuned.plugins.plugin_sysctl: Setting sysctl parameter 'kernel.sysrq' to '16'
2019-10-08 11:31:46,327 DEBUG    tuned.plugins.plugin_sysctl: Setting sysctl parameter 'kernel.core_uses_pid' to '1'
2019-10-08 11:31:46,327 DEBUG    tuned.plugins.plugin_sysctl: Setting sysctl parameter 'net.ipv4.conf.all.rp_filter' to '1'
2019-10-08 11:31:46,327 DEBUG    tuned.plugins.plugin_sysctl: Setting sysctl parameter 'net.ipv4.conf.all.accept_source_route' to '0'
2019-10-08 11:31:46,327 DEBUG    tuned.plugins.plugin_sysctl: Setting sysctl parameter 'net.ipv4.conf.all.promote_secondaries' to '1'
2019-10-08 11:31:46,327 DEBUG    tuned.plugins.plugin_sysctl: Setting sysctl parameter 'net.core.default_qdisc' to 'fq_codel'
2019-10-08 11:31:46,327 DEBUG    tuned.plugins.plugin_sysctl: Setting sysctl parameter 'fs.protected_hardlinks' to '1'
2019-10-08 11:31:46,327 DEBUG    tuned.plugins.plugin_sysctl: Setting sysctl parameter 'fs.protected_symlinks' to '1'
2019-10-08 11:31:46,327 DEBUG    tuned.plugins.plugin_sysctl: Finished applying sysctl settings from file /usr/lib/sysctl.d/50-default.conf
2019-10-08 11:31:46,327 DEBUG    tuned.plugins.plugin_sysctl: Applying sysctl settings from file /usr/lib/sysctl.d/50-libkcapi-optmem_max.conf
2019-10-08 11:31:46,327 DEBUG    tuned.plugins.plugin_sysctl: Setting sysctl parameter 'net.core.optmem_max' to '81920'
2019-10-08 11:31:46,327 DEBUG    tuned.plugins.plugin_sysctl: Finished applying sysctl settings from file /usr/lib/sysctl.d/50-libkcapi-optmem_max.conf
2019-10-08 11:31:46,327 DEBUG    tuned.plugins.plugin_sysctl: Applying sysctl settings from file /etc/sysctl.d/99-sysctl.conf
2019-10-08 11:31:46,328 DEBUG    tuned.plugins.plugin_sysctl: Finished applying sysctl settings from file /etc/sysctl.d/99-sysctl.conf
2019-10-08 11:31:46,328 DEBUG    tuned.plugins.plugin_sysctl: Applying sysctl settings from file /etc/sysctl.conf
2019-10-08 11:31:46,328 DEBUG    tuned.plugins.plugin_sysctl: Finished applying sysctl settings from file /etc/sysctl.conf
2019-10-08 11:31:46,328 INFO     tuned.daemon.daemon: static tuning from profile 'kernel-sec-cc' applied

In another window:

[root@b8 ~]# sysctl kernel.kptr_restrict
kernel.kptr_restrict = 1
[root@b8 ~]# sysctl kernel.yama.ptrace_scope
kernel.yama.ptrace_scope = 0

Actual results:
kernel.yama.ptrace_scope = 0

Expected results:
kernel.yama.ptrace_scope = 1

Additional info:
I suspected this might be something to do with:
https://github.com/redhat-performance/tuned/pull/160
but when I reverted, I got the same problem.

Setting the sysctl directly on the host works fine.

--- Additional comment from  on 2019-10-08 15:47:29 UTC ---

Actually I think I see the problem looking at the debug now... /usr/lib/sysctl.d/10-default-yama-scope.conf  Why would /usr/lib/sysctl.d have a precedence over a profile in /etc/tuned ?

--- Additional comment from Ondřej Lysoněk on 2019-10-09 13:58:25 UTC ---

No, it's not caused by that pull request. This is old behaviour, introduced in commit https://github.com/redhat-performance/tuned/commit/d1986f20f9913cc2f.

You can set 'reapply_sysctl=0' to override the behaviour. Perhaps it would be nice if it was possible to override it directly in the profile as well.

I'm not sure what is the exact reason for this behaviour. Perhaps something can be digged up in the bug linked from the commit - bug#1302953.

--- Additional comment from  on 2019-10-09 15:06:08 UTC ---

(In reply to Ondřej Lysoněk from comment #2)
> No, it's not caused by that pull request. This is old behaviour, introduced
> in commit
> https://github.com/redhat-performance/tuned/commit/d1986f20f9913cc2f.
> 
> You can set 'reapply_sysctl=0' to override the behaviour. Perhaps it would
> be nice if it was possible to override it directly in the profile as well.
> 
> I'm not sure what is the exact reason for this behaviour. Perhaps something
> can be digged up in the bug linked from the commit - bug#1302953.

Right, BZ1302953 is a great find!  So are we basically saying this is a feature?
While I agree that we probably want the default behaviour reapply_sysctl=1 for
/etc/sysctl.conf and /etc/sysctl.d/*.conf, I'm not quite convinced profiles in
/etc/tuned/ should be overriden by sysctl.conf files (such as
/usr/lib/sysctl.d/10-default-yama-scope.conf) owned by system packages even when
reapply_sysctl=1.  Perhaps the logic can stay, but exclude /usr/lib/sysctl.d/*.conf
when reapply_sysctl=1?  Thoughts?

--- Additional comment from Juan Antonio Osorio on 2019-11-06 09:38:58 UTC ---

Some security profiles (e.g. when applying the Common Criteria configuration) require /usr/lib/sysctl.d/10-default-yama-scope.conf to be overwritten. Any way we can do that from tuned?

--- Additional comment from Ondřej Lysoněk on 2019-11-06 14:24:05 UTC ---

(In reply to Juan Antonio Osorio from comment #4)
> Some security profiles (e.g. when applying the Common Criteria
> configuration) require /usr/lib/sysctl.d/10-default-yama-scope.conf to be
> overwritten. Any way we can do that from tuned?

You can set 'reapply_sysctl = 0' in /etc/tuned/tuned-main.conf. Does that help?

--- Additional comment from Juan Antonio Osorio on 2019-11-06 14:29:22 UTC ---

this is the only interface available to set sysctl settings in OpenShift https://github.com/openshift/cluster-node-tuning-operator. I'm unsure if I'm able to specifically set the value in /etc/tuned/tuned-main.conf .

--- Additional comment from  on 2019-11-06 15:23:46 UTC ---

(In reply to Juan Antonio Osorio from comment #6)
> this is the only interface available to set sysctl settings in OpenShift
> https://github.com/openshift/cluster-node-tuning-operator. I'm unsure if I'm
> able to specifically set the value in /etc/tuned/tuned-main.conf .

You cannot set this through using a custom tuned CR in the NTO at the moment.  Let's stick to the original BZ report and try to answer the question whether this behavior of the tuned daemon is a feature or a bug.

--- Additional comment from Juan Antonio Osorio on 2019-11-07 11:26:27 UTC ---

(In reply to jmencak from comment #7)
> (In reply to Juan Antonio Osorio from comment #6)
> > this is the only interface available to set sysctl settings in OpenShift
> > https://github.com/openshift/cluster-node-tuning-operator. I'm unsure if I'm
> > able to specifically set the value in /etc/tuned/tuned-main.conf .
> 
> You cannot set this through using a custom tuned CR in the NTO at the
> moment.  Let's stick to the original BZ report and try to answer the
> question whether this behavior of the tuned daemon is a feature or a bug.

Understood. However, this is something that we still need to figure out in order to address the recommended security setting. So, just wanted to clarify where this requirement came from in the first place.

Comment 15 errata-xmlrpc 2020-09-29 19:36:52 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (tuned bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:3884