From: Matthias Fischer <matthias.fischer@ipfire.org>
To: development@lists.ipfire.org
Subject: Testing squid 4.0.23 - grsec denied kernel module auto-load of nf_conntrack_netlink by uid 23
Date: Sun, 21 Jan 2018 01:50:56 +0100 [thread overview]
Message-ID: <9ee1de16-fc80-9c0f-e359-177b9e8931d0@ipfire.org> (raw)
[-- Attachment #1: Type: text/plain, Size: 778 bytes --]
Hi,
Just to keep in touch, I tested 'squid 4.0.23' yesterday - it seemed to
run fine at first. But after a while I took a closer look at the logs
and discovered a bunch of kernel messages within a few hours and I don't
know what exactly triggered these messages:
...
132 Time(s): grsec: denied kernel module auto-load of
nf_conntrack_netlink by uid 23
...
As far as I found out: "uid 23" => squid-user, and the new squid tried
to 'autoload' a module which 'grsec' didn't like. Is this a correct
interpretation and has anyone some useable clue how to avoid this?
Besides, after going back to '3.5.27' the messages didn't came back
again. '4.0.22' didn't throw these messages, too. They changed something
and I don't know what it is...
Thanks for all tips!
Best,
Matthias
next reply other threads:[~2018-01-21 0:50 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-01-21 0:50 Matthias Fischer [this message]
2018-01-21 18:57 ` Michael Tremer
2018-01-21 20:35 ` Matthias Fischer
2018-01-22 13:30 ` Michael Tremer
2018-03-10 11:22 ` Matthias Fischer
2018-03-11 10:20 ` Testing 'squid 4.0.24' (was: Re: Testing squid 4.0.23 - grsec denied kernel module auto-load of nf_conntrack_netlink by uid 23) Matthias Fischer
2018-03-11 13:05 ` Michael Tremer
2018-03-11 14:44 ` Testing 'squid 4.0.24' Matthias Fischer
2018-03-10 8:12 ` Testing squid 4.0.23 - grsec denied kernel module auto-load of nf_conntrack_netlink by uid 23 Matthias Fischer
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=9ee1de16-fc80-9c0f-e359-177b9e8931d0@ipfire.org \
--to=matthias.fischer@ipfire.org \
--cc=development@lists.ipfire.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox