newsyslog(8) patch for both size and time checks

Gavin Atkinson gavin at FreeBSD.org
Tue May 12 12:54:34 UTC 2009


On Tue, 2009-05-12 at 13:59 +0400, Dmitry Morozovsky wrote:
> Dear colleagues,
> 
> for now, if log is configured to be rotated in time manner, its size is not 
> checked, so /var/log may be DoSed by some service (in our case, it was mad DHCP 
> client which fills up our /var/log with dhcpd log; our newsyslog.conf line was
> 
> /var/log/dhcpd				640  5     5000	@T00	JC
> 
> The following simple patch should fix the problem. Any objection to commit 
> this?

Short answer: I believe you will find this patch breaks some newsyslog
functionality.  I can't remember what the problems are, but that patch
is pretty similar to my first attempt at fixing the problem too.

The patch I ended up creating is at
http://people.freebsd.org/~gavin/PRs/100018.diff (and a PR where
somebody else requested this functionality is bin/100018).

Gavin


More information about the freebsd-current mailing list