rsyslog can't start after accident power off or rebooting (due /var/run/rsyslogd.pid existence) (17.10)

Bug #1734008 reported by Dima
260
This bug affects 1 person
Affects Status Importance Assigned to Milestone
rsyslog (Ubuntu)
Expired
Undecided
Unassigned

Bug Description

1,2) See apport-bug attachment
3) Rsyslogd should be started anyway
4) If '/var/run/rsyslogd.pid' exists, rsyslogd won't start.

I will mark this issue as public security vulnerability, because no one can know what happened after sudden reboot while this issue exists.

ProblemType: Bug
DistroRelease: Ubuntu 17.10
Package: rsyslog 8.16.0-1ubuntu9
ProcVersionSignature: Ubuntu 4.13.0-17.20-generic 4.13.8
Uname: Linux 4.13.0-17-generic x86_64
ApportVersion: 2.20.7-0ubuntu3.5
Architecture: amd64
CurrentDesktop: LXDE
Date: Thu Nov 23 04:40:45 2017
InstallationDate: Installed on 2017-10-06 (47 days ago)
InstallationMedia: Lubuntu 17.10 "Artful Aardvark" - Alpha amd64 (20170926)
SourcePackage: rsyslog
UpgradeStatus: No upgrade log present (probably fresh install)

Revision history for this message
Dima (dima2017) wrote :
information type: Private Security → Public Security
summary: - rsyslog can't start after accident power off or rebooting
+ rsyslog can't start after accident power off or rebooting (due
+ /var/run/rsyslogd.pid existence)
summary: rsyslog can't start after accident power off or rebooting (due
- /var/run/rsyslogd.pid existence)
+ /var/run/rsyslogd.pid existence) (17.10)
Revision history for this message
Seth Arnold (seth-arnold) wrote :

Hi Dima, this is an interesting find. On my system /var/run is a symlink to /run which is a tmpfs, and thus created from scratch on every reboot.

Can you please report back if /var/run is a symlink to /run on your system or not, and what type of filesystem is actually used to store the pidfile?

Thanks

Changed in rsyslog (Ubuntu):
status: New → Incomplete
Revision history for this message
Dima (dima2017) wrote :

Hi Seth, thank you for your help.
No, my /var/run is not a symlink, it's a directory on btrfs. I will fix it, but I don't know how it happened. I didn't do it.

Revision history for this message
Launchpad Janitor (janitor) wrote :

[Expired for rsyslog (Ubuntu) because there has been no activity for 60 days.]

Changed in rsyslog (Ubuntu):
status: Incomplete → Expired
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.