2008/11/10 <[EMAIL PROTECTED]>: > On 10 Nov 2008 at 7:24, Brian Kroth wrote: > >> [EMAIL PROTECTED] <[EMAIL PROTECTED]> 2008-11-10 12:31:
[snip] >> grsec: denied resource overstep by requesting 4511036391424 for >> RLIMIT_STACK against limit 8388608 for /bin/pwd[pwd:18765] >> uid/euid:1000/1000 gid/egid:1000/1000, parent /bin/bash[bash:18636] >> uid/euid:1000/1000 gid/egid:1000/1000 > > now this one definitely looks fishy and spender's looking into it already. I experience a similar pattern with postfix. Here's a recent excerpt from my kernel buffer: [ 59.748463] grsec: denied resource overstep by requesting 6014915829760 for RLIMIT_STACK against limit 8388608 for /etc/postfix/postfix-script[postfix-script:2981] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/runscript.sh[runscript.sh:2962] uid/euid:0/0 gid/egid:0/0 [91229.698383] grsec: From 212.183.136.195: denied resource overstep by requesting 2982265733120 for RLIMIT_STACK against limit 8388608 for /etc/postfix/postfix-script[postfix-script:15670] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/runscript.sh[runscript.sh:15663] uid/euid:0/0 gid/egid:0/0 [91466.615149] grsec: From 212.183.136.195: denied resource overstep by requesting 7585593999360 for RLIMIT_STACK against limit 8388608 for /etc/postfix/postfix-script[postfix-script:15876] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/runscript.sh[runscript.sh:15869] uid/euid:0/0 gid/egid:0/0 [91852.302529] grsec: From 212.183.136.195: denied resource overstep by requesting 4286678908928 for RLIMIT_STACK against limit 8388608 for /etc/postfix/postfix-script[postfix-script:16148] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/runscript.sh[runscript.sh:16141] uid/euid:0/0 gid/egid:0/0 [97084.194476] grsec: From 192.168.254.88: denied resource overstep by requesting 12760106696704 for RLIMIT_STACK against limit 8388608 for /etc/postfix/postfix-script[postfix-script:18069] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/runscript.sh[runscript.sh:18062] uid/euid:0/0 gid/egid:0/0 [97084.591375] grsec: From 192.168.254.88: denied resource overstep by requesting 6147866898432 for RLIMIT_STACK against limit 8388608 for /etc/postfix/postfix-script[postfix-script:18084] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/runscript.sh[runscript.sh:18076] uid/euid:0/0 gid/egid:0/0 [97104.279223] grsec: From 192.168.254.88: denied resource overstep by requesting 3078062882816 for RLIMIT_STACK against limit 8388608 for /etc/postfix/postfix-script[postfix-script:18183] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/runscript.sh[runscript.sh:18175] uid/euid:0/0 gid/egid:0/0 [98499.165117] grsec: From 192.168.254.88: denied resource overstep by requesting 973333118976 for RLIMIT_STACK against limit 8388608 for /etc/postfix/postfix-script[postfix-script:18685] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/runscript.sh[runscript.sh:18677] uid/euid:0/0 gid/egid:0/0 [335157.025790] grsec: From 212.183.134.66: denied resource overstep by requesting 10497186820096 for RLIMIT_STACK against limit 8388608 for /etc/postfix/postfix-script[postfix-script:1557] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/runscript.sh[runscript.sh:1550] uid/euid:0/0 gid/egid:0/0 [431086.838131] grsec: From 192.168.254.88: denied resource overstep by requesting 3096323715072 for RLIMIT_STACK against limit 8388608 for /etc/postfix/postfix-script[postfix-script:23575] uid/euid:0/0 gid/egid:0/0, parent /lib64/rc/sh/runscript.sh[runscript.sh:23568] uid/euid:0/0 gid/egid:0/0 This has been going on for a long time now. I had assumed that postfix was to blame and was intending to investigate further at some point (but, of course, I never did). If there is anything that I can do that may help to shed light on the matter then please do let me know. Cheers, --Kerin
