Bug 988814 - wrong SYSLOG_FACILITY reported for authpriv messages, sshd logs in /var/log/messages, not /var/log/secure
wrong SYSLOG_FACILITY reported for authpriv messages, sshd logs in /var/log/m...
Product: Fedora
Classification: Fedora
Component: systemd (Show other bugs)
Unspecified Unspecified
unspecified Severity high
: ---
: ---
Assigned To: systemd-maint
Fedora Extras Quality Assurance
: 988163 (view as bug list)
Depends On:
  Show dependency treegraph
Reported: 2013-07-26 09:22 EDT by Tomas Heinrich
Modified: 2016-09-20 00:51 EDT (History)
13 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2013-09-13 07:45:36 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
should fix the problem (3.42 KB, patch)
2013-07-26 12:59 EDT, Zbigniew Jędrzejewski-Szmek
no flags Details | Diff

  None (edit)
Description Tomas Heinrich 2013-07-26 09:22:33 EDT
Description of problem:
Messages that should have SYSLOG_FACILITY 10 (authpriv) are logged by journald as if they have have SYSLOG_FACILITY 11 (ftp). This results in those message not appearing in /var/log/secure but in /var/log/messages.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
$ journalctl -o verbose -f
$ tail -f /var/log/{messages,secure}
$ logger -p authpriv.notice authpriv-msg

Inspect the outputs of the commands above.

Actual results:
Wrong facility is assigned to authpriv messages, i.e. SYSLOG_FACILITY=11 in journalctl's output.

Expected results:

Additional info:
If normal users are allowed access to logs with the 'ftp' facility, they can unintentionally get access to sshd logs.
Comment 1 Michal Schmidt 2013-07-26 10:06:05 EDT
void server_process_syslog_message(
        int priority = LOG_USER | LOG_INFO;
        syslog_parse_priority((char**) &buf, &priority);

void syslog_parse_priority(char **p, int *priority) {
        *priority = (*priority & LOG_FACMASK) | (a*100 + b*10 + c);

LOG_USER is (1<<3), in binary 1000.
authpriv.notice is <87>, in binary 1010111.
Thus in the end, in binary:
*priority = 1000 | 1010111 = 1011111, that is facility 11, level debug.

The priority calculation line was changed by:

Zbigniew, would you recheck this?
Comment 2 Michal Schmidt 2013-07-26 10:08:34 EDT
(In reply to Michal Schmidt from comment #1)
> authpriv.notice is <87>, in binary 1010111.

Sorry, this should say "authpriv.debug", which is what I actually used in my test.
Comment 3 Jason Tibbitts 2013-07-26 10:20:01 EDT
*** Bug 988163 has been marked as a duplicate of this bug. ***
Comment 4 Zbigniew Jędrzejewski-Szmek 2013-07-26 12:58:36 EDT
Yeah, looks like I messed up. Does the following patch (and the analysis in the commit message) make sense to you?
Comment 5 Zbigniew Jędrzejewski-Szmek 2013-07-26 12:59:35 EDT
Created attachment 778846 [details]
should fix the problem
Comment 6 Zbigniew Jędrzejewski-Szmek 2013-08-21 11:48:26 EDT
Committed upstream in http://cgit.freedesktop.org/systemd/systemd/commit/?id=ac50788b0.
Comment 7 Petr Lautrbach 2013-09-09 07:47:36 EDT
It seems to be already fixed in systemd-206-11.fc21.x86_64
Comment 8 Harald Hoyer 2013-09-13 07:45:36 EDT
Comment 9 Fedora Update System 2013-09-14 22:15:17 EDT
systemd-204-13.fc19 has been submitted as an update for Fedora 19.
Comment 10 Fedora Update System 2013-09-17 14:52:44 EDT
systemd-204-14.fc19 has been submitted as an update for Fedora 19.

Note You need to log in before you can comment on or make changes to this bug.