Logcheck devel - Feb 2009 - Bug#515156: logcheck: fails to run after upgrade from etch to lenny

Package: logcheck
Version: 1.2.69
Severity: grave
Justification: renders package unusable

Hi,

I've just upgraded a box from Etch to Lenny and my logcheck broke.

I'm getting mails like this from cron:
From: logcheck system account <logcheck at foo.example.com>

Warning: If you are seeing this message, your log files may not have been
checked!

Details:
Failed to get lockfile: /var/lock/logcheck/logcheck.lock

So I started investigating...

/var/lock/logcheck is owned by root:root and is drwxr-xr-x, so the logcheck
user can't write in there.
logcheck.postinst contains this:
        # Set Permissions on install, not upgrade
        if [ ! -n "$2" ]; then
          ...
          # just in case
          chown logcheck /var/lock/logcheck > /dev/null || true
        fi

So we chown the dir to logcheck only on fresh installs, just in case, huh?
/var/lock/logcheck is in the package, thus dpkg is smart and sets it to
root:root again on upgrade. Et voila, we can't lock anymore.

IMHO the permission setting should not be conditional here.

Regards
Evgeni

-- System Information:
Debian Release: 5.0
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: i386 (i686)

Kernel: Linux 2.6.28-x31-1
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages logcheck depends on:
ii  adduser            3.110                 add and remove users and groups
ii  bsd-mailx [mailx]  8.1.2-0.20081101cvs-2 A simple mail user agent
ii  cron               3.0pl1-105            management of regular background p
pn  lockfile-progs     <none>                (no description available)
pn  logtail            <none>                (no description available)
ii  mailx              1:20081101-2          Transitional package for mailx ren
ii  masqmail [mail-tra 0.2.21-4              A mailer for hosts without permane
ii  sysklogd [system-l 1.5-5                 System Logging Daemon

Versions of packages logcheck recommends:
pn  logcheck-database             <none>     (no description available)

Versions of packages logcheck suggests:
pn  syslog-summary                <none>     (no description available)

Package: logcheck
Version: 1.2.69

Hello

since updating to lenny i got every hour this waring.
Starting logcheck from shell via 
#su - logcheck -c "/usr/sbin/logcheck" logchec
works flawlessly

Maybe the script is started twice?


in "/usr/sbin/logcheck" i have added "$UID" to see in which
contest cron
ran the script.
That seems to be OK.

:/etc# ls -al /etc/cron.d/logcheck
-rw-r--r-- 1 root root 347 Jul 15  2005 /etc/cron.d/logcheck
# /etc/cron.d/logcheck: crontab entries for the logcheck package

PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root

@reboot         logcheck    if [ -x /usr/sbin/logcheck ]; then nice -n10
/usr/sbin/logcheck -R; fi
2 * * * *       logcheck    if [ -x /usr/sbin/logcheck ]; then nice -n10
//usr/sbin/logcheck; fi

:/etc# ll /etc/cron.hourly/
total 0



:/etc# ls -al /var/lock/logcheck/logcheck.lock
ls: cannot access /var/lock/logcheck/logcheck.lock: No such file or
directory

:/etc# ls -al /var/lock/logcheck/
total 8
drwxr-xr-x  2 logcheck logcheck 4096 Mar  3 14:02 .
drwxrwxrwt 11 root     root     4096 Mar  3 06:42 ..

:/etc# ls -al /etc/logcheck/
total 1160
drwxr-xr-x   9 root logcheck    4096 Mar  3 12:55 .
drwxr-xr-x 171 root root        8192 Mar  3 13:47 ..
-rwxr-s---   2 root logcheck    4096 Feb 25 14:42 cracking.d
drwxr-s---   2 root logcheck    4096 Apr 19  2005 cracking.ignore.d
-rw-r--r--   1 root logcheck     180 Apr 19  2004 header.txt
drwxr-s---   2 root logcheck    4096 Feb 27 12:52 ignore.d.paranoid
drwxr-s---   2 root logcheck    8192 Feb 27 12:52 ignore.d.server
drwxr-s---   2 root logcheck    4096 Feb 27 12:52 ignore.d.workstation
-rw-r-----   1 root logcheck    2582 Feb 11 12:57 logcheck.conf
-rw-r-----   1 root logcheck    1941 Jul 15  2005 logcheck.conf.dpkg-old
-rw-r-----   1 root logcheck     210 Mar  3 12:54 logcheck.logfiles
drwxr-s---   2 root logcheck    4096 Feb 25 14:42 violations.d
drwxr-s---   2 root logcheck    4096 Feb 25 14:42 violations.ignore.d


/etc# id logcheck
uid=109(logcheck) gid=109(logcheck) groups=109(logcheck),4(adm)






Warning: If you are seeing this message, your log files may not have been
checked! UID(109)

Details:
Failed to get lockfile: /var/lock/logcheck/logcheck.lock


Also verify that the logcheck user can read all files referenced in
/etc/logcheck/logcheck.logfiles!

declare -x HOME="/var/lib/logcheck"
declare -x LOGNAME="logcheck"
declare -x MAILTO="root"
declare -x OLDPWD
declare -x
PATH="/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin"
declare -x PWD="/var/lib/logcheck"
declare -x SHELL="/bin/sh"
declare -x SHLVL="2"

Your message dated Tue, 18 Aug 2009 08:37:32 -0400
with message-id <20090818123732.GA11162 at toroia.fbriere.dyndns.org>
and subject line Re: Bug#515156: Same bug after removal + reinstall
has caused the Debian Bug report #515156,
regarding logcheck: fails to run after upgrade from etch to lenny
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner at bugs.debian.org
immediately.)


-- 
515156: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=515156
Debian Bug Tracking System
Contact owner at bugs.debian.org with problems
-------------- next part --------------
An embedded message was scrubbed...
From: Evgeni Golov <sargentd at die-welt.net>
Subject: logcheck: fails to run after upgrade from etch to lenny
Date: Sat, 14 Feb 2009 01:58:24 +0100
Size: 3624
URL:
<http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20090818/5d61ba51/attachment.eml>
-------------- next part --------------
An embedded message was scrubbed...
From: =?iso-8859-1?B?RnLpZOlyaWMgQnJp6HJl?= <fbriere at fbriere.net>
Subject: Re: Bug#515156: Same bug after removal + reinstall
Date: Tue, 18 Aug 2009 08:37:32 -0400
Size: 2908
URL:
<http://lists.alioth.debian.org/pipermail/logcheck-devel/attachments/20090818/5d61ba51/attachment-0001.eml>