RHBA-2010:0211 - Bug Fix Advisory

Topic

An updated sysklogd package that fixes various bugs is now available.

Description

The sysklogd package contains two system utilities (syslogd and klogd)
which provide support for system logging. Syslogd and klogd run as daemons
(background processes) and log system messages to different places, like
sendmail logs, security logs, error logs, etc.

This update addresses the following issues:

• the Red Hat Enterprise Linux syslogd init script creates files which are

readable by the root user only whereas the sysklogd(8) man page indicated
that "If a file is created it is world readable". The man page has been
updated with the correct information. (BZ#460232)

• the "-S" option was added to sysklogd 1.4.1-40, however, this option is

not displayed in the "SYNOPSIS" section of the sysklogd man page. This has
the potential to mislead users who use the man page for help. The "-S"
option has now been added to the "SYNOPSIS" section of the sysklogd man
page. (BZ#471174)

• when syslogd was started using the "-m" option with a non-zero argument,

the "errno" value of "select" was checked by the functions that log the
"MARK" message after the value had been reset from "EINTR" to "EINVAL".
This resulted in an incorrect message being logged to "/var/log/messages"
of the form; "syslogd: select: Invalid argument". A patch has been applied
to store the value of "errno" in a temporary variable prior to it being
reset and testing this stored value against "EINTR" for logging purposes.
The error message no longer appears in "/var/log/messages" when a non-zero
argument is passed to the "-m" option. (BZ#472875)

• syslogd.conf would cause a memory leak by forwarding messages to its IP

address, for example "*.*@192.168.122.5". This would result in processes
being terminated by the "OOM killer" to free up memory. A patch has been
applied to ensure that messages are not self-forwarded. (BZ#481600)

• when syslog messages were logged to the console, line feeds were not

inserted resulting in all messages being displayed on a single line. A
patch has been applied to ensure that each message appears on a new line.
(BZ#490897)

• if the "SIGALRM" signal was triggered during processing of the

"writeev()" function, syslog would cease logging to the console and
print a "/dev/console: Interrupted system call" message. Additionally,
log messages were truncanted in the event that the I/O buffer became full.
A patch has been applied to reschedule the "SIGALRM" signal prior to
calling the "writeev()" function to ensure messages are correctly
displayed to the console. (BZ#506683)

Users of sysklogd should upgrade to this updated package, which resolves
these issues.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 460232 - syslog creates files with mode 0600
• BZ - 471174 - syslogd man page enhancement request
• BZ - 472875 - Using -m option results in 'select: Invalid argument' messages in the log
• BZ - 490897 - syslog does not include a newline when logging to console/tty
• BZ - 506683 - syslogd stops writing any messages to /dev/console after an EINTR in syscall

CVEs

(none)

References

(none)