Bug#391353: [Pkg-aide-maintainers] Bug#391353: aide: Doesn't work suitably on Xen enabled kernel because of statically linked libc

[Marc Haber]

tags #391353 help
# help needed to link aide statically against non-tls glibc or dietlibc
thanks

On Fri, Oct 06, 2006 at 08:58:16AM +0200, Raphael Hertzog wrote:
> I upgraded my personal server to etch and choosed to use a Xen enabled
> kernel since we're going to have Xen support in etch (and also because
> we're using this for the new alioth.debian.org so I wanted to have a
> testbed for me).
> 
> This morning my server was almost unreachable and while looking through
> the logs I discovered those messages:
> Oct  6 05:17:34 arrakeen kernel: printk: 246 messages suppressed.
> Oct  6 05:17:34 arrakeen kernel: 4gb seg fixup, process aide (pid 1627), cs:ip 73:080ae335
> Oct  6 05:17:40 arrakeen kernel: printk: 291 messages suppressed.
> Oct  6 05:17:40 arrakeen kernel: 4gb seg fixup, process aide (pid 1627), cs:ip 73:080ae335
> 
> Those messages appear when you use the standard libc6 instead of libc6-xen
> on a Xen enabled kernel.

That is a kernel bug, these messages should have a rate limit to not
take the server down. I'm cloning the bug to the kernel because of
that.

>  However I have libc6-xen installed.... but aide is using its own
>  statically linked libc6 which thus generates this message.

Yes, that's a feature, see README.Debian.gz, section "statically
linked".

> Those messages means that the kernel worked around the bad libc6 but it's
> extremely ineffective in doing so, so much that it effectively DOSsed my
> server during the 3 hours when aide was running.

Kernel bug.

> I see two solutions:
> - either you link again libc6 dynamically

That's going to render aide useless, see README.Debian.gz.

> - either you provide two versions of the binary and you use alternatives
>   (or you modify the cron script to detect /proc/xen and to start the
>   right binary)

Send a patch, please.

A third solution would be to link aide either against dietlibc or the
non-tls version of glibc. I do not have a clue how to do this.

> However it looks like there's no "libc6-xen-dev" to link statically a
> xen-enabled libc6...

That would be a libc6 bug.

> So for etch, the right thing to do might be to provide additionnaly
> a binary dynamically linked and to use the dynamic one if you detect
> /proc/xen.

I beg to differ. I'll probably make aide bail out if /proc/xen is
detected.

Greetings
Marc

-- 
-----------------------------------------------------------------------------
Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
Mannheim, Germany  |  lose things."    Winona Ryder | Fon: *49 621 72739834
Nordisch by Nature |  How to make an American Quilt | Fax: *49 621 72739835