From mboxrd@z Thu Jan  1 00:00:00 1970
From: Matthias Fischer <matthias.fischer@ipfire.org>
To: development@lists.ipfire.org
Subject: Re: Testing squid 4.0.23 - grsec denied kernel module auto-load of
 nf_conntrack_netlink by uid 23
Date: Sat, 10 Mar 2018 12:22:42 +0100
Message-ID: <99886b28-7278-ad12-0eb4-6cb31d416c2e@ipfire.org>
In-Reply-To: <1516627843.3647.173.camel@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============8001390873967979528=="
List-Id: <development.lists.ipfire.org>

--===============8001390873967979528==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Hi,

Found something...but since I don't have much experience with this:

What impact is to be expected when I translate 'squid 4.0.24' with the
configure option '--without-netfilter-conntrack'?

Help says:
"--without-netfilter-conntrack
Do not use Netfilter conntrack libraries for packet marking. A path to
alternative library location may be specified by using
--with-netfilter-conntrack=3DPATH.
Default: auto-detect."

I didn't find any further or helpful informations about the
(side-)effects when I turn this off.

Best,
Matthias

On 22.01.2018 14:30, Michael Tremer wrote:
> Okay, please keep an eye on squid 4 for us then. I am not following this ve=
ry
> closely and have no idea what will change in squid 4.
>=20
> Best,
> -Michael
>=20
> On Sun, 2018-01-21 at 21:35 +0100, Matthias Fischer wrote:
>> On 21.01.2018 19:57, Michael Tremer wrote:
>> > Hello,
>> >=20
>> > yes this is correct.
>> >=20
>> > We don't allow an unprivileged user to load any kernel modules.
>>=20
>> Ok, then my suspicion was right.
>>=20
>> > What does squid need this for? Why are you playing around with squid 4?
>>=20
>> 1. I don't know. 3.5.27 doesn't do this.
>> 2. As I wrote - just to keep in touch with their development. Once in a
>> while, 'squid 3' will be deprecated and I wanted to see what comes next,
>> even though this may take a long time. Just being curious and the
>> 'Devel' was somehow bored. ;-)
>>=20
>> > You should be able to load the module first and then start squid.
>>=20
>> I'm not that curious - this was for testing and for testing only.
>>=20
>> Best,
>> Matthias
>>=20
>> > Best,
>> > -Michael
>> >=20
>> > On Sun, 2018-01-21 at 01:50 +0100, Matthias Fischer wrote:
>> > > Hi,
>> > >=20
>> > > Just to keep in touch, I tested 'squid 4.0.23' yesterday - it seemed to
>> > > run fine at first. But after a while I took a closer look at the logs
>> > > and discovered a bunch of kernel messages within a few hours and I don=
't
>> > > know what exactly triggered these messages:
>> > >=20
>> > > ...
>> > > 132 Time(s): grsec: denied kernel module auto-load of
>> > > nf_conntrack_netlink by uid 23
>> > > ...
>> > >=20
>> > > As far as I found out: "uid 23" =3D> squid-user, and the new squid tri=
ed
>> > > to 'autoload' a module which 'grsec' didn't like. Is this a correct
>> > > interpretation and has anyone some useable clue how to avoid this?
>> > >=20
>> > > Besides, after going back to '3.5.27' the messages didn't came back
>> > > again. '4.0.22' didn't throw these messages, too. They changed somethi=
ng
>> > > and I don't know what it is...
>> > >=20
>> > > Thanks for all tips!
>> > >=20
>> > > Best,
>> > > Matthias


--===============8001390873967979528==--