Package: src:linux-grsec
Version: 4.7.8-1+grsec201610161720+1~bpo8+1
Severity: critical
Justification: breaks unrelated software
* What led up to the situation? : On service startup, error message in
kern.log
* What exactly did you do (or not do) that was effective (or ineffective)? :
service amavis start. Error in kern.log
Error in the log file :
2016-12-22T09:14:23+01:00 server kernel: : [57702.220709] grsec: denied
untrusted exec (due to not being in trusted group and file in non-root-owned
directory) of
/var/lib/spamassassin/compiled/5.020/3.004000/auto/Mail/SpamAssassin/CompiledRegexps/body_0/body_0.so
by /usr/sbin/amavisd-new[/usr/sbin/amavi:32440] uid/euid:121/121
gid/egid:127/127, parent /lib/systemd/systemd[systemd:1] uid/euid:0/0
gid/egid:0/0
2016-12-22T09:14:23+01:00 server kernel: : [57702.221957] grsec: denied
untrusted exec (due to not being in trusted group and file in non-root-owned
directory) of
/var/lib/spamassassin/compiled/5.020/3.004000/auto/Mail/SpamAssassin/CompiledRegexps/body_500/body_500.so
by /usr/sbin/amavisd-new[/usr/sbin/amavi:32440] uid/euid:121/121
gid/egid:127/127, parent /lib/systemd/systemd[systemd:1] uid/euid:0/0
gid/egid:0/0
* But the user is in the grsec-tpe group
# id -a amavis
uid=121(amavis) gid=127(amavis)
groupes=127(amavis),64040(grsec-tpe),64044(grsec-proc)
# getent group grsec-tpe
grsec-tpe:x:64040: root,postfix,munin,nagios,amavis,debian-spamd
* Package info
# dpkg -l amavisd-new spamassassin
Souhait=inconnU/Installé/suppRimé/Purgé/H=à garder
|
État=Non/Installé/fichier-Config/dépaqUeté/échec-conFig/H=semi-installé/W=attend-traitement-déclenchements
|/ Err?=(aucune)/besoin Réinstallation (État,Err: majuscule=mauvais)
||/ Nom Version Architecture
Description
+++-====================================-=======================-=======================-=============================================================================
ii amavisd-new 1:2.10.1-2~deb8u1 all
Interface between MTA and virus scanner/content filters
ii spamassassin 3.4.0-6 all
Perl-based spam filter using text analysis
-- Package-specific info:
** Version:
Linux version 4.7.0-1-grsec-amd64 ([email protected]<mailto:[email protected]>)
(gcc version 4.9.2 (Debian 4.9.2-10) ) #1 SMP Debian
4.7.8-1+grsec201610161720+1~bpo8+1 (2016-10-20)
Best regards,
------------------------
Eric KLEINDIENST
Conseil de l'Europe
DIT / Infogérance Serveurs, Base de données et Open Source
