Cron script uses up all space in /run

[Chris Newcomer]

The /etc/cron.daily/aide script sets a variable $TMPBASE to "/run/aide". Each time this script is run (daily), it moves the current data in /run/aide/cron.daily to a directory with a random name: /run/aide/cron.daily.old.XXXXXXXXXX.

When doing this, it preserves all the data from the previous run and adds approximately the same amount of data from the current run. Eventually, all this data will fill up the /run filesystem.

This bug will affect anyone that has run the CIS hardening scripts on their systems. We would like this to be fixed so that this is not the default behavior.

root@my-server:/run# df -h /run
Filesystem Size Used Avail Use% Mounted on
tmpfs 796M 796M 0 100% /run

root@my-server:/run# du -sch * | grep -vE '^0|K'
794M aide
1.3M udev
796M total

root@my-server:/run# du -sch aide/* | grep -vE '^0|K'
99M aide/cron.daily
100M aide/cron.daily.old.1MV71MCH2b
100M aide/cron.daily.old.6Vli33Nc11
99M aide/cron.daily.old.CECwDp5c8s
100M aide/cron.daily.old.HxbiTwfaIW
100M aide/cron.daily.old.lZEPrqsxkR
794M total

[Joshua Powers (powersj)]

# Steps to reproduce

1. $ multipass launch bionic --name b1
2. $ multipass exec b1 bash
3. $ sudo apt update
4. $ sudo apt install aide
5. At the MTA configuration select "No configuration"
6. $ sudo run-parts /etc/cron.daily
7. $ sudo run-parts /etc/cron.daily
8. $ sudo ls /run/aide

At this point, the /run/aide directory will have a cron.daily and cron.daily.old* folder

It appears that the aide crontab will fail if an MTA is not configured or is not even running. Instead of selecting "No configuration" stopping the postfix process will cause the same failure.

# Possible workarounds/fixes

1. Remove `set -e` from /etc/cron.daily/aide or add `set +e` around the postfix section to ensure the cronjob completes even if the MTA is down

2. If this is due to a unconfigured MTA, then ensure that it is configured For example, set the MTA to a local configuration:

$ sudo debconf-set-selections <<< "postfix postfix/main_mailer_type select 'Local only'"
$ sudo dpkg-reconfigure -f noninteractive postfix

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.