Package: memlockd Version: 1.3-2+b1 Severity: normal File: /etc/memlockd.cfg Usertags: warnings
The default /etc/memlockd.cfg contains an ancient libc6 version, which
means that libc6 won't be locked in memory by memlockd, which could
lead to system unavailability, which is meant to be fixed by memlockd.
Luckily other parts of the default config (like loading bash) will
automatically lock libc, but the default config still means that
memlockd will log errors when trying to load the old libc, which
means that sysadmins will have to filter those out using logcheck.
Just upgrading the version number to the latest isn't going to be
helpful, since it will quickly get out of date. I suggest that you
introduce a * prefix character that will use glob() on the path and
lock all the files resulting from that. The default config can then
contain a glob like ld-[0-9].[0-9][0-9].so and thus match any libc,
at least until glibc 2.100 :)
$ grep -- -2 /etc/memlockd.cfg
/lib/$ARCH-linux-gnu/libnss_nis-2.24.so
/lib/$ARCH-linux-gnu/libnss_files-2.24.so
/lib/$ARCH-linux-gnu/libnss_compat-2.24.so
/lib/$ARCH-linux-gnu/ld-2.24.so
$ ls -l /lib/*-linux-gnu/ld-*.so
-rwxr-xr-x 1 root root 198K Feb 21 16:47 /lib/x86_64-linux-gnu/ld-2.33.so*
$ apt policy libc6
libc6:
Installed: 2.33-7
Candidate: 2.33-7
Version table:
2.34-0experimental3 700
700 https://deb.debian.org/debian experimental/main amd64 Packages
*** 2.33-7 900
900 https://deb.debian.org/debian testing/main amd64 Packages
800 https://deb.debian.org/debian unstable/main amd64 Packages
100 /var/lib/dpkg/status
-- System Information:
Debian Release: bookworm/sid
APT prefers testing-debug
APT policy: (900, 'testing-debug'), (900, 'testing'), (800,
'unstable-debug'), (800, 'unstable'), (790, 'buildd-unstable'), (700,
'experimental-debug'), (700, 'experimental'), (690, 'buildd-experimental')
Architecture: amd64 (x86_64)
Kernel: Linux 5.16.0-3-amd64 (SMP w/8 CPU threads; PREEMPT)
Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=en_AU.utf8, LC_CTYPE=en_AU.utf8 (charmap=UTF-8), LANGUAGE=en_AU:en
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages memlockd depends on:
ii adduser 3.118
memlockd recommends no packages.
memlockd suggests no packages.
-- no debconf information
--
bye,
pabs
https://wiki.debian.org/PaulWise
signature.asc
Description: This is a digitally signed message part
