search for: suid_dump

Hello, I update my dovecot to the last Version, now I have this error in the audit Log. Can any tell me what I can do, without selinux disabled // SELinux hindert /usr/sbin/dovecot daran, mit getattr-Zugriff auf Datei /proc/ sys/fs/suid_dumpable zuzugreifen. ***** Plugin catchall (100. Wahrscheinlichkeit) schl?gt vor ************** If you believe that dovecot should be allowed getattr access on the suid_dumpable file by default. Dann sie sollten dies als Fehler melden. Um diesen Zugriff zu erlauben, k?nnen Sie ein lokales Richtl...

...me='org.fedoraproject.Setroubleshootd' (using servicehelper) Jul 12 16:24:55 mx01 dbus[3008]: [system] Successfully activated service 'org.fedoraproject.Setroubleshootd' Jul 12 16:24:55 mx01 setroubleshoot: SELinux is preventing dovecot from getattr access on the file /proc/sys/fs/suid_dumpable. For complete SELinux messages run: sealert -l c46ae6a7-64c4-49a7-9e3d-477547fb6da8 Jul 12 16:24:55 mx01 python: SELinux is preventing dovecot from getattr access on the file /proc/sys/fs/suid_dumpable.#012#012***** Plugin catchall (100. confidence) suggests **************************#012...

...ve ran all kinds of (stress) tests and I can't reproduce this crash. I was able to reproduce the original hang though. > Unfortunately, the core was not dumped.... And I don't know what to do: the director service was not chrooted, and ulimit -c is unlimited. Do you have: sysctl -w fs.suid_dumpable=2 -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://dovecot.org/pipermail/dovecot/attachments/20180918/cde1dc3b/attachment-0001.html>

...10:33, Joan Moreau via dovecot <dovecot at dovecot.org> wrote: > > Difficult to figure out without a coredump + gdb > > > > I have also battled quite a lot to make sure dovecot can core dump on my Archlinux servers. > > I remember that the key point was putting fs.suid_dumpable=2 in /etc/sysctl.d/ conf files, LimitCORE=infinity in /etc/systemd/system/multi-user.target.wants/dovecot.service, and rebooting the server. > > My own coredumps are on /var/lib/systemd/coredump/ > > > -------------- next part -------------- An HTML attachment was scrubbed....

...ugh the assertion will happen whenever there is a non ascii > > char that is also non qpair in the local part, ie > > !smtp_char_is_atext(*p) and !smtp_char_is_qpair(*p). > > Could somebody please point me in the direction how to obtain a > coredump here? I found sysctl -w fs.suid_dumpable=2 but where will coredumps be written? -- Ralf Hildebrandt Gesch?ftsbereich IT | Abteilung Netzwerk Charit? - Universit?tsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt at charite.de | h...

...on failed: (errno != 0) Mar 07 11:01:29 auth: Warning: auth client 13625 disconnected with 19 pending requests: EOF Mar 07 11:01:29 pop3-login: Fatal: master: service(pop3-login): child 13625 killed with signal 6 (core not dumped - https://dovecot.org/bugreport.html#coredumps - set /proc/sys/fs/suid_dumpable to 2) Hoping the above is enough to debug -- Tom

Hi, i have a problem with libclucene-core.so.2.3.3.4. I See segfault error to messages log, when dovecot store mail to INBOX. set 12 13:41:21 box02.par-tec.it kernel: doveadm-server[20285]: segfault at 38 ip 00007f575b68fc42 sp 00007ffc0272e750 error 4 in libclucene-core.so.2.3.3.4[7f575b569000+188000] set 12 13:41:22 box02.par-tec.it kernel: doveadm-server[18871]: segfault at 38 ip

...=CLD_KILLED, si_pid=30932, si_uid=0, si_status=SIGSEGV, si_utime=3, si_stime=1} --- [pid 30711] write(62, "\0", 1) = 1 [pid 30711] read(124, "8x\0\0008\0\0\0\251\3\0\0", 1020) = 12 [pid 30711] read(61, "\0", 64) = 1 [pid 30711] open("/proc/sys/fs/suid_dumpable", O_RDONLY) = 227 [pid 30711] read(227, "0\n", 9) = 2 [pid 30711] write(65, "25 30932 FATAL service(doveadm): child 30932 killed with signal 11 (core not dumped - https://dovecot.org/bugreport.html#coredumps - set /proc/sys/fs/suid_dumpable to 2)\n", 170) = 170...

...) [0x55facfdae3c1] -> /lib64/libc.so.6(__libc_start_main+0xf3) [0x7fe76dd93413] -> dovecot/auth(_start+0x2e) [0x55facfdae57e] Mar 28 10:04:47 auth: Fatal: master: service(auth): child 31162 killed with signal 6 (core not dumped - https://dovecot.org/bugreport.html#coredumps - set /proc/sys/fs/suid_dumpable to 2) Mar 28 10:04:48 master: Info: Dovecot v2.3.3 (dcead646b) starting up for imap, pop3 -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://dovecot.org/pipermail/dovecot/attachments/20190328/0e1d94a7/attachment.html>

...org>> wrote: >>> >>> Difficult to figure out without a coredump + gdb >>> >>> >>> I have also battled quite a lot to make sure dovecot can core dump on my Archlinux servers. >>> >>> I remember that the key point was putting*fs.suid_dumpable=2* in /etc/sysctl.d/ conf files, *LimitCORE=infinity* in /etc/systemd/system/multi-user.target.wants/dovecot.service, and rebooting the server. >>> >>> My own coredumps are on /var/lib/systemd/coredump/ >>> >>> >> -------------- next part --------...

Alas, I've set fs.suid_dumpable to 2 but the core is not dumped. So far I've checked: - ulimit -c unlimited, done - /proc/sys/kernel/core_pattern is set to /var/tmp/core.%p - /var/tmp is chmod 1777 - daemon is not chrooted - sysctl -w fs.suid_dumpable=2 - dir /var/tmp is empty and filesystem has 2GB free This is the l...

...=CLD_KILLED, si_pid=30932, si_uid=0, si_status=SIGSEGV, si_utime=3, si_stime=1} --- [pid 30711] write(62, "\0", 1) = 1 [pid 30711] read(124, "8x\0\0008\0\0\0\251\3\0\0", 1020) = 12 [pid 30711] read(61, "\0", 64) = 1 [pid 30711] open("/proc/sys/fs/suid_dumpable", O_RDONLY) = 227 [pid 30711] read(227, "0\n", 9) = 2 [pid 30711] write(65, "25 30932 FATAL service(doveadm): child 30932 killed with signal 11 (core not dumped - https://dovecot.org/bugreport.html#coredumps - set /proc/sys/fs/suid_dumpable to 2)\n", 170) = 170...

...si_status=SIGSEGV, si_utime=3, si_stime=1} --- >> [pid 30711] write(62, "\0", 1)????????? = 1 >> [pid 30711] read(124, "8x\0\0008\0\0\0\251\3\0\0", 1020) = 12 >> [pid 30711] read(61, "\0", 64)????????? = 1 >> [pid 30711] open("/proc/sys/fs/suid_dumpable", O_RDONLY) = 227 >> [pid 30711] read(227, "0\n", 9)???????? = 2 >> [pid 30711] write(65, "25 30932 FATAL service(doveadm): child 30932 >> killed with signal 11 (core not dumped - >> https://dovecot.org/bugreport.html#coredumps - set >> /proc...

...mtp-client-connection.c: line 1142 (smtp_client_connection_established): assertion failed: (!conn->connect_succeeded) 2019-11-18 20:17:51 lmtp(17274): Fatal: master: service(lmtp): child 17274 killed with signal 6 (core not dumped - https://dovecot.org/bugreport.html#coredumps - set /proc/sys/fs/suid_dumpable to 2) Is a core dump required to find the source of that error? Thanks for any help! $ doveconf -n # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # OS: Linux 4.9.0-8-amd64 x86_64 # Hostname: m03.company.com auth_cache_negative_ttl = 65 secs auth_cache_ttl = 3 mins auth_cache_verify_passwo...

...=CLD_KILLED, si_pid=30932, si_uid=0, si_status=SIGSEGV, si_utime=3, si_stime=1} --- [pid 30711] write(62, "\0", 1) = 1 [pid 30711] read(124, "8x\0\0008\0\0\0\251\3\0\0", 1020) = 12 [pid 30711] read(61, "\0", 64) = 1 [pid 30711] open("/proc/sys/fs/suid_dumpable", O_RDONLY) = 227 [pid 30711] read(227, "0\n", 9) = 2 [pid 30711] write(65, "25 30932 FATAL service(doveadm): child 30932 killed with signal 11 (core not dumped - https://dovecot.org/bugreport.html#coredumps - set /proc/sys/fs/suid_dumpable to 2)\n", 170) = 170...

...cot.so.0(i_fatal+0) [0x7fa1c8c5ebc9] -> /usr/lib/dovecot/libdovecot.so.0(+ [snip...] lmtp(test at test.net)<7988><cDK3ADztDls0HwAANIsFaQ>: Fatal: master: service(lmtp): child 7988 killed with signal 6 (core not dumped - https://dovecot.org/bugreport.html#coredumps - set /proc/sys/fs/suid_dumpable to 2) At least my problem is fixed - so thank you! ________________________________ From: Stephan Bosch <stephan at rename-it.nl> Sent: 30 May 2018 13:41 To: Barry Pearce; dovecot at dovecot.org Subject: Re: Struggling with sieve, fileinto and variables. Op 30-5-2018 om 14:01 schreef...

...y does produce cores when it crashes, so there's something different about these indexer processes..) One thing that often works is: mkdir /var/core; chmod 0777 /var/core echo "/var/core/%p" > /proc/sys/kernel/core_pattern If that doesn't help, you can also try: sysctl -w fs.suid_dumpable=2 (and disable afterwards) Also if you can get indexer-worker to start without crashing (new mail delivery works?) you can attach gdb into it and wait for it to crash (gdb -p <indexer-worker pid>, cont).

...om> q5sLCGRy615ZDgAATn/NZw Saved) Jun 18 15:55:48 mail1 postfix/qmgr[3458]: 18533C009C8: removed Jun 18 15:55:48 mail1 dovecot[1833]: replicator: Fatal: master: service(replicator): child 2948 killed with signal 6 (core not dumped - https://dovecot.org/bugreport.html#coredumps - set /proc/sys/fs/suid_dumpable to 2) -------------- next part -------------- An HTML attachment was scrubbed... URL: <https://dovecot.org/pipermail/dovecot/attachments/20200814/55c8c14c/attachment-0001.html>

...cation leaks memory in login process. * Linux: Core dumping is no longer enabled by default via PR_SET_DUMPABLE, because this may allow attackers to bypass chroot/group restrictions. Found by cPanel Security Team. Nowadays core dumps can be safely enabled by using "sysctl -w fs.suid_dumpable=2". If the old behaviour is wanted, it can still be enabled by setting: import_environment=$import_environment PR_SET_DUMPABLE=1 - imap-login with SSL/TLS connections may end up in infinite loop

...ystem, which wants to catch all of this and handle it directly. Say something like ?sudo yum remove abrt*? 2. Override the default sysctl telling where core dumps land by writing this file, /etc/sysctl.d/10-core.conf: kernel.core_pattern = /tmp/core-%e-%p kernel.core_uses_pid = 1 fs.suid_dumpable = 2 Then apply those settings with ?sudo sysctl ?system?. I don?t remember what the default is, which this overrides, but I definitely didn?t want it. You can choose any pattern you like, just remember what permissions the service runs under, because that?s the permission needed by the proce...