Re: Login 'postgres': Login class 'default': Setting priority failed: Permission denied

On Thu, Jun 27, 2024 at 3:45 PM Denis Shaposhnikov <dsh@bamus.cz> wrote:

> Hi,
>
> On Thu, 27 Jun 2024, at 21:29, Paul Procacci wrote:
> >> nice -n 5 doas id
>
> >> Jun 27 21:08:57 db doas[33054]: Login 'root': Login class 'root':
> Setting priority failed: Permission denied
>
> > The error message is a legit error, that is, you cannot set a priority
> > of a process from within the jail.
>
> What do you mean? Just
>
> nice -5 id
>
> inside a jail doesn't generate the log message, but
>
> nice -5 doas id
>
> does. That was just an example. Actually Icinga runs a command, but before
> that it does `nice(5)`. That command uses doas and calls a script and that
> script uses su. I'm not setting a priority directly. In 14.0 all of that
> didn't generate log messages.
>
> > It's just newly logged.
>
> Aha! Thanks for the info. OK, how could I prevent it from logging it? I
> don't need it in the log every minute.
>

It *does* throw an error.  You just need to set the priority in the right
direction:

# nice -n 5 id
uid=0(root) gid=0(wheel) groups=0(wheel),5(operator)

# nice -n -5 id
nice: setpriority: Permission denied
uid=0(root) gid=0(wheel) groups=0(wheel),5(operator)

You have 3 options:

1) Remove the nice binary from the command that icinga is issuing.
2) Lower the priority of the command (higher value)
3) Redirect stderr to /dev/null.

~Paul
-- 
__________________

:(){ :|:& };: