Subject: [Pkg-cacti-maint] Processed: bug not in cacti

From: [email-masked] (Debian Bug Tracking System)
Date: Mon, 09 Apr 2012 11:06:31 +0000

Processing commands for [email-masked]:

> clone 566609 -1
Bug #566609 [cacti] [cacti] Logs are filling up with suhosin alerts about cacti trying to increase memory_limit
Bug 566609 cloned as bug 668157
> reassign -1 php5-cli
Bug #668157 [cacti] [cacti] Logs are filling up with suhosin alerts about cacti trying to increase memory_limit
Bug reassigned from package 'cacti' to 'php5-cli'.
No longer marked as found in versions cacti/0.8.7e-1.1 and cacti/0.8.7e-3.
Ignoring request to alter fixed versions of bug #668157 to the same values previously set
> retitle -1 provide proper memory_limit in /etc/php5/cli/php.ini
Bug #668157 [php5-cli] [cacti] Logs are filling up with suhosin alerts about cacti trying to increase memory_limit
Changed Bug title to 'provide proper memory_limit in /etc/php5/cli/php.ini' from '[cacti] Logs are filling up with suhosin alerts about cacti trying to increase memory_limit'
> retitle 566609 add suhosin.memory_limit in /etc/cron.d/cacti
Bug #566609 [cacti] [cacti] Logs are filling up with suhosin alerts about cacti trying to increase memory_limit
Changed Bug title to 'add suhosin.memory_limit in /etc/cron.d/cacti' from '[cacti] Logs are filling up with suhosin alerts about cacti trying to increase memory_limit'
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
566609: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=566609
668157: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=668157
Debian Bug Tracking System
Contact [email-masked] with problems

---

From: Paul Gevers <[email-masked]>
Date: Mon, 09 Apr 2012 13:03:13 +0200

clone 566609 -1
reassign -1 php5-cli

Sorry for not responding for such a long time.

Question, does this "--define suhosin.memory_limit=512M" also work if
php5-suhosin is not installed? I.e. does it break systems that don't use it?

Paul

---

From: Francois Beaulieu <[email-masked]>
Date: Tue, 1 May 2012 11:51:55 -0400

Hi Paul,

I've confirmed that cacti continues to work with "--define suhosin.memory_limit=512M" specified and php5-suhosin uninstalled. There seems to be no negative impact on having it specified when not using suhosin.

However, I've determined that for all error messages to disappear, you must make three changes:

- Set memory_limit to a reasonable value (like 128M) in /etc/php5/cli/php.ini, it cannot be "-1".
- Modify /etc/cron.d/cacti to look like this:
"*/1 * * * * www-data php --define suhosin.memory_limit=512M /usr/share/cacti/site/poller.php >/dev/null 2>/var/log/cacti/poller-error.log"
- and modify /usr/share/cacti/site/poller.php, line 297 to look like this:
"$extra_args     = "-q --define suhosin.memory_limit=512M \"" . $config["base_path"] . "/cmd.php\"";"

Thanks,

François Beaulieu
1194 Stanley
Montréal (Québec) H3B 2S7
Bureau: 514.667.0691 poste 2061
Courriel: [email-masked]<mailto:[email-masked]> | Web: www.securebyknowledge.com<http://www.securebyknowledge.com/>

On 2012-04-09, at 7:03 AM, Paul Gevers wrote:

clone 566609 -1
reassign -1 php5-cli

Paul

---

From: Paul Gevers <[email-masked]>
Date: Tue, 01 May 2012 18:52:08 +0200

François,

> - Set memory_limit to a reasonable value (like 128M) in
> /etc/php5/cli/php.ini, it cannot be "-1".

This should be done by php5-cli in bug 668157 [1]

[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=668157

> "*/1 * * * * www-data php *--define suhosin.memory_limit=512M*
> /usr/share/cacti/site/poller.php >/dev/null
> 2>/var/log/cacti/poller-error.log"

I will add this for the next upload of cacti.

> "$extra_args     = "-q *--define suhosin.memory_limit=512M* \"" .
> $config["base_path"] . "/cmd.php\"";"

Could you please fill an issue for this upstream at [2]? I don't think
so, or is this really a Debian issue?

[2] http://bugs.cacti.net/

Paul

---

From: Paul Gevers <[email-masked]>
Date: Tue, 01 May 2012 19:34:29 +0200

> Agreed! But, historically, this type of request has been filed as WONTFIX.

Than there is nothing we can do. We as the cacti maintainers can not
change /etc/php5/cli/php.ini

> It's somewhat specific to Debian, as it is Debian that auto-installs
> php5-suhosin with php.

Ok. But I suggest you still try as there may be more distributions
having this issue and also users that are using php5-suhosin themselves.
If the answer is no, than I guess we will have to patch this
indefinitely, which we will by the way.

Paul
PS, please respond to the bug report. There is no need to e-mail me
privately. If you don't want to go through the bts, please use the
pkg-cacti-maint e-mail address.

---

From: Francois Beaulieu <[email-masked]>
Date: Wed, 2 May 2012 19:18:57 -0400

It appears to be solved upstream:

http://bugs.cacti.net/view.php?id=1583

François Beaulieu

On 2012-05-01, at 1:34 PM, Paul Gevers wrote:

---

From: Paul Gevers <[email-masked]>
Date: Thu, 03 May 2012 18:42:21 +0200

>> It appears to be solved upstream:

Which part?

>> http://bugs.cacti.net/view.php?id=1583

This change (revision 5717) never made it completely to the 0.8.X branch
and remained in main. They did make nearly the same change to the 0.8.7
branch in revision 5743 (April 2010), without the configuration part.

So I wonder:
- on which version of cacti did you do your verifications?
- do we still need the --define suhosin.memory_limit lines, even if a
proper memory_limit is set by cacti's scripts? As I understand it, yes,
or are those suhosin limits taken from the php memory_limit?

Paul

---

From: Francois Beaulieu <[email-masked]>
Date: Thu, 3 May 2012 14:02:22 -0400

On 2012-05-03, at 12:42 PM, Paul Gevers wrote:

Which part?

I have not had a chance to verify it personally, but they seem to no longer use ini_set within cmd.php or other cacti php scripts, according to the notes. This would mean that we would not need to modify the scripts to add --define suhosin.memory_limit to script calls.

Has it made it into v0.8.8? The case notes certainly indiciate that it did.

I have not tested against any versions other than the v0.8.7g provided by Debian.

We will need to define suhosin.memory_limit in all versions that don't include the fix. From my understanding of the fix, users may also need to add it manually to the scripts in the fixed version if they define a non-standard memory_limit in config.pgp. However, since by default the memory_limit will be fixed to 512M globally, no script will use ini_set to increase its memory, and suhosin will thus no longer complain even when suhosin.memory_limit isn't defined. This is my understanding, but is untested, so it may be wrong. (I have no time to set up and est a non-debian version right now.)

Thanks,
François Beaulieu

---

From: Paul Gevers <[email-masked]>
Date: Thu, 03 May 2012 20:28:29 +0200

> I have not had a chance to verify it personally, but they seem to no
> longer use ini_set within cmd.php or other cacti php scripts, according
> to the notes. This would mean that we would not need to modify the
> scripts to add --define suhosin.memory_limit to script calls.
> 

(My typo, the original revision was 5617 [1])

Well, the biggest part went into 0.8.7something, except for the
possibility to configure the limit and the fact that the ini_set was
done in global.php instead of the two last scripts. Reading from the
diffs, there are two scripts left that use ini_set:

paul@stromboli ~/cacti/cacti $ grep -n ini_set\(\"memory_limit *
cmd.php:64:ini_set("memory_limit", "512M");
poller.php:211:ini_set("memory_limit", "512M");

> I have not tested against any versions other than the v0.8.7g provided

The "changes" were already included in that version. So your tests are
the same for 0.8.8.

> We will need to define suhosin.memory_limit in all versions that don't
> include the fix. From my understanding of the fix, users may also need
> to add it manually to the scripts in the fixed version if they define a
> non-standard memory_limit in config.pgp. However, since by default the
> memory_limit will be fixed to 512M globally, no script will use ini_set
> to increase its memory, and suhosin will thus no longer complain even
> when suhosin.memory_limit isn't defined. This is my understanding, but
> is untested, so it may be wrong. (I have no time to set up and est a
> non-debian version right now.)

See my comments above. But even if global.php would set the
memory_limit, the issue would still be there wouldn't it? I.e. asking
the cacti developers to port the changes in 5617 wouldn't really help
anyway.

By the way, from your proposed solution: the fact that a php script can
call (via command line) an other php script while setting the
suhosin.memory_limit defeats the purpose of suhosin quite a bit, doesn't
it? Seems like a hole in the system.

Paul

[1] http://svn.cacti.net/viewvc?view=rev&revision=5617

---

From: Francois Beaulieu <[email-masked]>
Date: Thu, 3 May 2012 15:13:24 -0400

On 2012-05-03, at 2:28 PM, Paul Gevers wrote:

Well, the biggest part went into 0.8.7something, except for the
possibility to configure the limit and the fact that the ini_set was
done in global.php instead of the two last scripts.

The part that was left out is the only important part, in regards to this bug...

Reading from the

Which are the same two that I my proposed fix modifies by hand.

That depends entirely on how it is implemented. It all boils down to: do the individual scripts still call ini_set to change their memory_limit themselves. If so, then we still need to define suhosin.memory_limit. If not, then suhosin won't complain: it only complains when a script tries to increase it's memory limit mid-run.

That's a whole different argument. Most people don't seem to find the suhosin patch to be particularly useful... It appears to be quite a kludge. Don't know if my fix uses a "hole" per se; I assume that the suhosin devs feel that suhosin is meant only to protect against misbehaving scripts and external attacks. If a user is able to modify the script or call them from the command line, then all bets are off and suhosin is useless anyways.

François Beaulieu