From mboxrd@z Thu Jan  1 00:00:00 1970
From: Michael Tremer <michael.tremer@ipfire.org>
To: development@lists.ipfire.org
Subject: Re: Testing squid 4.0.23 - grsec denied kernel module auto-load of
 nf_conntrack_netlink by uid 23
Date: Mon, 22 Jan 2018 13:30:43 +0000
Message-ID: <1516627843.3647.173.camel@ipfire.org>
In-Reply-To: <855ef12e-8ea6-3411-f2f7-755736697861@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============3253179245003279968=="
List-Id: <development.lists.ipfire.org>

--===============3253179245003279968==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit

Okay, please keep an eye on squid 4 for us then. I am not following this very
closely and have no idea what will change in squid 4.

Best,
-Michael

On Sun, 2018-01-21 at 21:35 +0100, Matthias Fischer wrote:
> On 21.01.2018 19:57, Michael Tremer wrote:
> > Hello,
> > 
> > yes this is correct.
> > 
> > We don't allow an unprivileged user to load any kernel modules.
> 
> Ok, then my suspicion was right.
> 
> > What does squid need this for? Why are you playing around with squid 4?
> 
> 1. I don't know. 3.5.27 doesn't do this.
> 2. As I wrote - just to keep in touch with their development. Once in a
> while, 'squid 3' will be deprecated and I wanted to see what comes next,
> even though this may take a long time. Just being curious and the
> 'Devel' was somehow bored. ;-)
> 
> > You should be able to load the module first and then start squid.
> 
> I'm not that curious - this was for testing and for testing only.
> 
> Best,
> Matthias
> 
> > Best,
> > -Michael
> > 
> > On Sun, 2018-01-21 at 01:50 +0100, Matthias Fischer wrote:
> > > Hi,
> > > 
> > > Just to keep in touch, I tested 'squid 4.0.23' yesterday - it seemed to
> > > run fine at first. But after a while I took a closer look at the logs
> > > and discovered a bunch of kernel messages within a few hours and I don't
> > > know what exactly triggered these messages:
> > > 
> > > ...
> > > 132 Time(s): grsec: denied kernel module auto-load of
> > > nf_conntrack_netlink by uid 23
> > > ...
> > > 
> > > As far as I found out: "uid 23" => squid-user, and the new squid tried
> > > to 'autoload' a module which 'grsec' didn't like. Is this a correct
> > > interpretation and has anyone some useable clue how to avoid this?
> > > 
> > > Besides, after going back to '3.5.27' the messages didn't came back
> > > again. '4.0.22' didn't throw these messages, too. They changed something
> > > and I don't know what it is...
> > > 
> > > Thanks for all tips!
> > > 
> > > Best,
> > > Matthias
> > > 
> > > 
> 
> 

--===============3253179245003279968==
Content-Type: application/pgp-signature
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="signature.asc"
MIME-Version: 1.0

LS0tLS1CRUdJTiBQR1AgU0lHTkFUVVJFLS0tLS0KCmlRSXpCQUFCQ2dBZEZpRUU1L3JXNWwzR0dl
Mnlwa3R4Z0hudy8yK1FDUWNGQWxwbDU0TUFDZ2tRZ0hudy8yK1EKQ1FkaXhoQUFvRXZLM0tyVmNX
ZVFwd0w4cERwRkRtSjlvTklxaE1mSkpzeGNvaVJjUFRUektBQlEvSnV4QlR2egp0dUtncDdPeWlT
ZjZ4cWhoNnp2YVJaSHkzd0VkRTIxblB5am1rWjVUSnAvTHNBM0VBdW9rdmdoR2pFMnZJbnpiCldY
MEljbW1id1BxS0ZTZmhHUDFSbHQraU9jT3hOdnYwSTBkYzN2SDJaTmdhL1RjdG9PK0lMNmMvZmVx
WGFZV0oKN3VYeldYcm5xYkRTeENMWFlSZU81cWVyd2JHVlRzOVU2S1BGRFhoTXZLVFFLVXpWRGV6
WDhZNHRwbEhPZUQxMwpSNmZ3dzVSdDFqNFhCdDNaRWMwZy9JSGU3V1AybWNZd2FLbmd3eHVwSHZ3
c1FSVURGbE51Mm9rV0l5SGhTVlI1CnZDejlIQ3d0NTE0ZG9GTmthRzZsaVJTTjM1c1lObzJGV1hE
MUJENEFNUjVIM01FVVZDOFhWcFhnVVRiM3hmcDIKK0lKR0xVWVBlNFJZcE1jNStLdU1ibUdhQnYr
MHRCVWQxZW9oTW8yc0NpWW4wL1NhTmF2d2xKOHZ5ejcybTg0cQoyK1dzdnhDYm1aSFBHODJtME84
MitVZU9jSVRmViszMUdEYzJlWGdtZ0ZtL2s0dnhTTGpnOHpQTmpjeDVwdHhGCmtmVTFIcVlzRDdj
SzRTbFNDZTJQS2RUd3NtVWhjZXFYQTBkZ2p3TENHL01kQm1rYmRtMThTMTYwY0ZMR1YrdHAKcW9S
WklvZ2VJbDlVRlo2UXVyeE1EWE1xTXRuNVlyenc4QlR6L1BNWXdVOG1vdUdEMzZIVDJiTXpUaUJ6
OVlScgpxL1FNaHRjVjNOYUtEOElrVnRHa0YvdFV0a290blN0azZld2s5MFRwTFZWTFJGTEJSN009
Cj1oZUxVCi0tLS0tRU5EIFBHUCBTSUdOQVRVUkUtLS0tLQo=

--===============3253179245003279968==--