Re: newsyslog(8) patch for both size and time checks

From: Gavin Atkinson <gavin_at_FreeBSD.org>
Date: Tue, 12 May 2009 13:54:30 +0100
On Tue, 2009-05-12 at 13:59 +0400, Dmitry Morozovsky wrote:
> Dear colleagues,
> 
> for now, if log is configured to be rotated in time manner, its size is not 
> checked, so /var/log may be DoSed by some service (in our case, it was mad DHCP 
> client which fills up our /var/log with dhcpd log; our newsyslog.conf line was
> 
> /var/log/dhcpd				640  5     5000	_at_T00	JC
> 
> The following simple patch should fix the problem. Any objection to commit 
> this?

Short answer: I believe you will find this patch breaks some newsyslog
functionality.  I can't remember what the problems are, but that patch
is pretty similar to my first attempt at fixing the problem too.

The patch I ended up creating is at
http://people.freebsd.org/~gavin/PRs/100018.diff (and a PR where
somebody else requested this functionality is bin/100018).

Gavin
Received on Tue May 12 2009 - 10:54:34 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:39:47 UTC