cvs commit: src/lib/libc/gen syslog.c

[David Malone]

On Sun, Oct 10, 2004 at 02:16:12PM +0400, Gleb Smirnoff wrote:

[Sorry - I sent Gleb feedback on this earlier this week but I've been
busy and so didn't have a chance to follow up on it properly.]

> 1. Not forever.

If syslogd has hung (as opposed to being busy), it will wait forever.
Try "killall -STOP syslogd" and then logging a bundle of messages.
With the old situation other services continue to run, with the new
situation every program that calls syslog(3) end up stuck.

> 3. If /var/run/log is overflowed that means that your machine is already
> slowed down by syslogd process and its IO. Your application is already
> not doing its best.

> Better have consistent logs later to investigate that DoS. An attacker
> may trigger that DoS intentionally to hide some messages, which will
> be logged if syslogd is not overflowed.

This can happen in situations other than DoSs. Previously there
have been situations where syslogd hangs if a serial console becomes
confused or because of a coding error. This change makes it impossible
to su and fix the problem. IMHO, this is worse than loosing syslog
messages.

(I guess if someone can log enough messages to the syslog socket
to cause ENOBUFS, they can also log enough messages to fill up /var
and have syslogd stop logging because the disk is full.)

	David.