+++ This bug was initially created as a clone of Bug #1759597 +++ Description of problem: Tuned fails to set certain sysctls (e.g. kernel.yama.ptrace_scope). Version-Release number of selected component (if applicable): [root@b8 ~]# rpm -qi tuned Name : tuned Version : 2.12.0 Release : 3.el8 Architecture: noarch Install Date: Tue 08 Oct 2019 11:26:12 AM EDT Group : Unspecified Size : 732634 License : GPLv2+ Signature : RSA/SHA256, Fri 16 Aug 2019 01:11:51 PM EDT, Key ID 199e2f91fd431d51 Source RPM : tuned-2.12.0-3.el8.src.rpm Build Date : Fri 16 Aug 2019 12:19:45 PM EDT Build Host : x86-vm-08.build.eng.bos.redhat.com Relocations : (not relocatable) Packager : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla> Vendor : Red Hat, Inc. URL : http://www.tuned-project.org/ Summary : A dynamic adaptive system tuning daemon Description : The tuned package contains a daemon that tunes system settings dynamically. It does so by monitoring the usage of several system components periodically. Based on that information components will then be put into lower or higher power saving modes to adapt to the current usage. Currently only ethernet network and ATA harddisk devices are implemented. How reproducible: Always Steps to Reproduce: [root@b8 ~]# sysctl kernel.kptr_restrict kernel.kptr_restrict = 0 [root@b8 ~]# sysctl kernel.yama.ptrace_scope kernel.yama.ptrace_scope = 0 [root@b8 ~]# cat /etc/tuned/kernel-sec-cc/tuned.conf [main] summary=A custom profile for kernel sysctl settings related to the CC profile [sysctl] kernel.kptr_restrict=1 #kernel.dmesg_restrict=1 #kernel.perf_event_paranoid=2 #kernel.kexec_load_disabled=1 kernel.yama.ptrace_scope=1 [root@b8 ~]# tuned --debug --no-dbus ... 2019-10-08 11:31:46,323 INFO tuned.daemon.daemon: Using 'kernel-sec-cc' profile 2019-10-08 11:31:46,323 INFO tuned.profiles.loader: loading profile: kernel-sec-cc 2019-10-08 11:31:46,324 INFO tuned.daemon.controller: starting controller 2019-10-08 11:31:46,324 INFO tuned.daemon.daemon: starting tuning 2019-10-08 11:31:46,324 DEBUG tuned.plugins.repository: creating plugin sysctl 2019-10-08 11:31:46,325 DEBUG tuned.utils.plugin_loader: loading module tuned.plugins.plugin_sysctl 2019-10-08 11:31:46,325 DEBUG tuned.units.manager: creating 'sysctl' (sysctl) 2019-10-08 11:31:46,325 DEBUG tuned.plugins.base: initializing instance sysctl (sysctl) 2019-10-08 11:31:46,325 DEBUG tuned.hardware.inventory: starting monitor observer 2019-10-08 11:31:46,326 DEBUG tuned.plugins.plugin_sysctl: Value of sysctl parameter 'kernel.kptr_restrict' is '0' 2019-10-08 11:31:46,326 DEBUG tuned.plugins.plugin_sysctl: Setting sysctl parameter 'kernel.kptr_restrict' to '1' 2019-10-08 11:31:46,326 DEBUG tuned.plugins.plugin_sysctl: Value of sysctl parameter 'kernel.yama.ptrace_scope' is '0' 2019-10-08 11:31:46,326 DEBUG tuned.plugins.plugin_sysctl: Setting sysctl parameter 'kernel.yama.ptrace_scope' to '1' 2019-10-08 11:31:46,326 INFO tuned.plugins.plugin_sysctl: reapplying system sysctl 2019-10-08 11:31:46,326 DEBUG tuned.plugins.plugin_sysctl: Applying sysctl settings from file /usr/lib/sysctl.d/10-default-yama-scope.conf 2019-10-08 11:31:46,326 DEBUG tuned.plugins.plugin_sysctl: Setting sysctl parameter 'kernel.yama.ptrace_scope' to '0' 2019-10-08 11:31:46,326 DEBUG tuned.plugins.plugin_sysctl: Finished applying sysctl settings from file /usr/lib/sysctl.d/10-default-yama-scope.conf 2019-10-08 11:31:46,326 DEBUG tuned.plugins.plugin_sysctl: Applying sysctl settings from file /usr/lib/sysctl.d/50-coredump.conf 2019-10-08 11:31:46,326 DEBUG tuned.plugins.plugin_sysctl: Setting sysctl parameter 'kernel.core_pattern' to '|/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h %e' 2019-10-08 11:31:46,327 DEBUG tuned.plugins.plugin_sysctl: Finished applying sysctl settings from file /usr/lib/sysctl.d/50-coredump.conf 2019-10-08 11:31:46,327 DEBUG tuned.plugins.plugin_sysctl: Applying sysctl settings from file /usr/lib/sysctl.d/50-default.conf 2019-10-08 11:31:46,327 DEBUG tuned.plugins.plugin_sysctl: Setting sysctl parameter 'kernel.sysrq' to '16' 2019-10-08 11:31:46,327 DEBUG tuned.plugins.plugin_sysctl: Setting sysctl parameter 'kernel.core_uses_pid' to '1' 2019-10-08 11:31:46,327 DEBUG tuned.plugins.plugin_sysctl: Setting sysctl parameter 'net.ipv4.conf.all.rp_filter' to '1' 2019-10-08 11:31:46,327 DEBUG tuned.plugins.plugin_sysctl: Setting sysctl parameter 'net.ipv4.conf.all.accept_source_route' to '0' 2019-10-08 11:31:46,327 DEBUG tuned.plugins.plugin_sysctl: Setting sysctl parameter 'net.ipv4.conf.all.promote_secondaries' to '1' 2019-10-08 11:31:46,327 DEBUG tuned.plugins.plugin_sysctl: Setting sysctl parameter 'net.core.default_qdisc' to 'fq_codel' 2019-10-08 11:31:46,327 DEBUG tuned.plugins.plugin_sysctl: Setting sysctl parameter 'fs.protected_hardlinks' to '1' 2019-10-08 11:31:46,327 DEBUG tuned.plugins.plugin_sysctl: Setting sysctl parameter 'fs.protected_symlinks' to '1' 2019-10-08 11:31:46,327 DEBUG tuned.plugins.plugin_sysctl: Finished applying sysctl settings from file /usr/lib/sysctl.d/50-default.conf 2019-10-08 11:31:46,327 DEBUG tuned.plugins.plugin_sysctl: Applying sysctl settings from file /usr/lib/sysctl.d/50-libkcapi-optmem_max.conf 2019-10-08 11:31:46,327 DEBUG tuned.plugins.plugin_sysctl: Setting sysctl parameter 'net.core.optmem_max' to '81920' 2019-10-08 11:31:46,327 DEBUG tuned.plugins.plugin_sysctl: Finished applying sysctl settings from file /usr/lib/sysctl.d/50-libkcapi-optmem_max.conf 2019-10-08 11:31:46,327 DEBUG tuned.plugins.plugin_sysctl: Applying sysctl settings from file /etc/sysctl.d/99-sysctl.conf 2019-10-08 11:31:46,328 DEBUG tuned.plugins.plugin_sysctl: Finished applying sysctl settings from file /etc/sysctl.d/99-sysctl.conf 2019-10-08 11:31:46,328 DEBUG tuned.plugins.plugin_sysctl: Applying sysctl settings from file /etc/sysctl.conf 2019-10-08 11:31:46,328 DEBUG tuned.plugins.plugin_sysctl: Finished applying sysctl settings from file /etc/sysctl.conf 2019-10-08 11:31:46,328 INFO tuned.daemon.daemon: static tuning from profile 'kernel-sec-cc' applied In another window: [root@b8 ~]# sysctl kernel.kptr_restrict kernel.kptr_restrict = 1 [root@b8 ~]# sysctl kernel.yama.ptrace_scope kernel.yama.ptrace_scope = 0 Actual results: kernel.yama.ptrace_scope = 0 Expected results: kernel.yama.ptrace_scope = 1 Additional info: I suspected this might be something to do with: https://github.com/redhat-performance/tuned/pull/160 but when I reverted, I got the same problem. Setting the sysctl directly on the host works fine. --- Additional comment from on 2019-10-08 15:47:29 UTC --- Actually I think I see the problem looking at the debug now... /usr/lib/sysctl.d/10-default-yama-scope.conf Why would /usr/lib/sysctl.d have a precedence over a profile in /etc/tuned ? --- Additional comment from Ondřej Lysoněk on 2019-10-09 13:58:25 UTC --- No, it's not caused by that pull request. This is old behaviour, introduced in commit https://github.com/redhat-performance/tuned/commit/d1986f20f9913cc2f. You can set 'reapply_sysctl=0' to override the behaviour. Perhaps it would be nice if it was possible to override it directly in the profile as well. I'm not sure what is the exact reason for this behaviour. Perhaps something can be digged up in the bug linked from the commit - bug#1302953. --- Additional comment from on 2019-10-09 15:06:08 UTC --- (In reply to Ondřej Lysoněk from comment #2) > No, it's not caused by that pull request. This is old behaviour, introduced > in commit > https://github.com/redhat-performance/tuned/commit/d1986f20f9913cc2f. > > You can set 'reapply_sysctl=0' to override the behaviour. Perhaps it would > be nice if it was possible to override it directly in the profile as well. > > I'm not sure what is the exact reason for this behaviour. Perhaps something > can be digged up in the bug linked from the commit - bug#1302953. Right, BZ1302953 is a great find! So are we basically saying this is a feature? While I agree that we probably want the default behaviour reapply_sysctl=1 for /etc/sysctl.conf and /etc/sysctl.d/*.conf, I'm not quite convinced profiles in /etc/tuned/ should be overriden by sysctl.conf files (such as /usr/lib/sysctl.d/10-default-yama-scope.conf) owned by system packages even when reapply_sysctl=1. Perhaps the logic can stay, but exclude /usr/lib/sysctl.d/*.conf when reapply_sysctl=1? Thoughts? --- Additional comment from Juan Antonio Osorio on 2019-11-06 09:38:58 UTC --- Some security profiles (e.g. when applying the Common Criteria configuration) require /usr/lib/sysctl.d/10-default-yama-scope.conf to be overwritten. Any way we can do that from tuned? --- Additional comment from Ondřej Lysoněk on 2019-11-06 14:24:05 UTC --- (In reply to Juan Antonio Osorio from comment #4) > Some security profiles (e.g. when applying the Common Criteria > configuration) require /usr/lib/sysctl.d/10-default-yama-scope.conf to be > overwritten. Any way we can do that from tuned? You can set 'reapply_sysctl = 0' in /etc/tuned/tuned-main.conf. Does that help? --- Additional comment from Juan Antonio Osorio on 2019-11-06 14:29:22 UTC --- this is the only interface available to set sysctl settings in OpenShift https://github.com/openshift/cluster-node-tuning-operator. I'm unsure if I'm able to specifically set the value in /etc/tuned/tuned-main.conf . --- Additional comment from on 2019-11-06 15:23:46 UTC --- (In reply to Juan Antonio Osorio from comment #6) > this is the only interface available to set sysctl settings in OpenShift > https://github.com/openshift/cluster-node-tuning-operator. I'm unsure if I'm > able to specifically set the value in /etc/tuned/tuned-main.conf . You cannot set this through using a custom tuned CR in the NTO at the moment. Let's stick to the original BZ report and try to answer the question whether this behavior of the tuned daemon is a feature or a bug. --- Additional comment from Juan Antonio Osorio on 2019-11-07 11:26:27 UTC --- (In reply to jmencak from comment #7) > (In reply to Juan Antonio Osorio from comment #6) > > this is the only interface available to set sysctl settings in OpenShift > > https://github.com/openshift/cluster-node-tuning-operator. I'm unsure if I'm > > able to specifically set the value in /etc/tuned/tuned-main.conf . > > You cannot set this through using a custom tuned CR in the NTO at the > moment. Let's stick to the original BZ report and try to answer the > question whether this behavior of the tuned daemon is a feature or a bug. Understood. However, this is something that we still need to figure out in order to address the recommended security setting. So, just wanted to clarify where this requirement came from in the first place.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (tuned bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:3884