Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory (rsyslog bug fix and enhancement update), and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHBA-2020:3932
Description of problem: When rsyslog is configured to read from imfile located on a directory referred as a symlink and labeled with var_t, rsyslog dies with following backtrace: -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- Program terminated with signal 11, Segmentation fault. #0 0x00007efdca236cd7 in process_symlink (chld=chld@entry=0x563611ba6030, symlink=symlink@entry=0x7efdb00022c0 "/var/log/myplace_symlink") at imfile.c:710 710 uint idx = ustrlen(chld->active->name) - ustrlen(chld->active->basename); #0 0x00007efdca236cd7 in process_symlink (chld=chld@entry=0x563611ba6030, symlink=symlink@entry=0x7efdb00022c0 "/var/log/myplace_symlink") at imfile.c:710 #1 0x00007efdca2370cb in poll_tree (chld=0x563611ba6030) at imfile.c:754 #2 0x00007efdca23284d in fs_node_walk (node=<optimized out>, f_usr=f_usr@entry=0x7efdca236e60 <poll_tree>) at imfile.c:957 #3 0x00007efdca232859 in fs_node_walk (node=<optimized out>, f_usr=f_usr@entry=0x7efdca236e60 <poll_tree>) at imfile.c:958 #4 0x00007efdca232859 in fs_node_walk (node=<optimized out>, f_usr=f_usr@entry=0x7efdca236e60 <poll_tree>) at imfile.c:958 #5 0x00007efdca232859 in fs_node_walk (node=<optimized out>, f_usr=f_usr@entry=0x7efdca236e60 <poll_tree>) at imfile.c:958 #6 0x00007efdca236591 in doPolling () at imfile.c:1925 #7 runInput (pThrd=<optimized out>) at imfile.c:2152 #8 0x0000563610eb74f4 in thrdStarter (arg=0x563611baf0a0) at ../threads.c:226 #9 0x00007efdcdd8fea5 in start_thread (arg=0x7efdbe22d700) at pthread_create.c:307 #10 0x00007efdcce838dd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111 -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- This is due to act_obj_add() function returning no error but not setting chld->active pointer, leading to a NULL pointer dereference (chld->active->name) Version-Release number of selected component (if applicable): rsyslog-8.24.0-52.el7.x86_64 and later How reproducible: Always Steps to Reproduce: 1. Create a imfile path with top directory being a symlink -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- # mkdir -p /var/my/place # ln -s /var/my/place /var/log/myplace_symlink # ls -Zd /var/my/place /var/log/myplace_symlink lrwxrwxrwx. root root unconfined_u:object_r:var_log_t:s0 /var/log/myplace_symlink -> /var/my/place drwxr-xr-x. root root unconfined_u:object_r:var_t:s0 /var/my/place -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- 2. Create imfile snippet rsyslog imfile configuration (/etc/rsyslog.d/imfile.conf): -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- module(load="imfile" PollingInterval="10") input(type="imfile" file="/var/log/myplace_symlink/file.log" tag="myplace_file" severity="info" facility="local5" ) -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- 3. Start rsyslog -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- # systemctl restart rsyslog # systemctl status rsyslog [...] Process: 5725 ExecStart=/usr/sbin/rsyslogd -n $SYSLOGD_OPTIONS (code=killed, signal=SEGV) [...] -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- Actual results: Coredump Expected results: No coredump Additional info: Coredump analysis We have act_obj_add() on line 708 called and returning a success, even though we entered "else" condition on line 576, which only prints a statement but doesn't make the function fail. -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- 694 static rsRetVal 695 process_symlink(fs_edge_t *const chld, const char *symlink) 696 { : 708 if (act_obj_add(chld, target, is_file, fileInfo.st_ino, 0, symlink) == RS_RET_OK) { 709 /* need to watch parent target as well for proper rotation support */ 710 uint idx = ustrlen(chld->active->name) - ustrlen(chld->active->basename); : 725 finalize_it: 726 free(target); 727 RETiRet; 728 } 554 static rsRetVal 555 act_obj_add(fs_edge_t *const edge, const char *const name, const int is_file, 556 const ino_t ino, const int is_symlink, const char *const source) 557 { : 573 const int fd = open(name, O_RDONLY | O_CLOEXEC); 574 if(fd < 0) { 575 if (is_file) { LogMsg(errno, RS_RET_ERR, LOG_WARNING, "imfile: error accessing file '%s'", name); 576 } else { DBGPRINTF("imfile: error accessing file '%s'", name); } 577 FINALIZE; 578 } : 620 finalize_it: 621 if(iRet != RS_RET_OK) { 622 if(act != NULL) { 623 free(act->name); 624 free(act); 625 } 626 } 627 RETiRet; 628 } -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- See also SELinux BZ #1823669