fail2ban

Commit Graph

Author	SHA1	Message	Date
Nicolas Collignon	39667ff6f7	FD_CLOEXEC support * 001-fail2ban-server-socket-close-on-exec-no-leak.diff Add code that marks server and client sockets with FD_CLOEXEC flags. Avoid leaking file descriptors to processes spawned when handling fail2ban actions (ex: iptables). Unix sockets managed by fail2ban-server don't need to be passed to any child process. Fail2ban already uses the FD_CLOEXEC flags in the filter code. This patch also avoids giving iptables access to fail2ban UNIX socket in a SELinux environment (A sane SELinux policy should trigger an audit event because "iptables" will be given read/write access to the fail2ban control socket). Some random references related to this bug: http://sourceforge.net/tracker/?func=detail&atid=689044&aid=2086568&group_id=121032 http://www.redhat.com/archives/fedora-selinux-list/2009-June/msg00124.html http://forums.fedoraforum.org/showthread.php?t=234230 * 002-fail2ban-filters-close-on-exec-typo-fix.diff There is a typo in the fail2ban server/filter.py source code. The FD_CLOEXEC is correctly set but additional random flags are also set. It has no side-effect as long as the fd doesn't match a valid flag :) "fcntl.fcntl(fd, fcntl.F_SETFD, fd \| fcntl.FD_CLOEXEC)" <== the 3rd parameter should be flags, not a file descriptor. * 003-fail2ban-gamin-socket-close-on-exec-no-leak.diff Add code that marks the Gamin monitor file descriptor with FD_CLOEXEC flags. Avoid leaking file descriptors to processes spawned when handling fail2ban actions (ex: iptables). --- File descriptors in action process before patches: dr-x------ 2 root root 0 . dr-xr-xr-x 8 root root 0 .. lr-x------ 1 root root 64 0 -> /dev/null <== OK l-wx------ 1 root root 64 1 -> /tmp/test.log <== used by test action lrwx------ 1 root root 64 2 -> /dev/null <== OK lrwx------ 1 root root 64 3 -> socket:[116361] <== NOK (fail2ban.sock leak) lr-x------ 1 root root 64 4 -> /proc/20090/fd <== used by test action l-wx------ 1 root root 64 5 -> /var/log/fail2ban.log <== OK lrwx------ 1 root root 64 6 -> socket:[115608] <== NOK (gamin sock leak) File descriptors in action process after patches: dr-x------ 2 root root 0 . dr-xr-xr-x 8 root root 0 .. lr-x------ 1 root root 64 0 -> /dev/null <== OK l-wx------ 1 root root 64 1 -> /tmp/test.log <== used by test action lrwx------ 1 root root 64 2 -> /dev/null <== OK lr-x------ 1 root root 64 3 -> /proc/18284/fd <== used by test action l-wx------ 1 root root 64 5 -> /var/log/fail2ban.log <== OK	12 years ago
Yaroslav Halchenko	c6f5d854d3	ENH+BF: filtergamin -- to be more inline with current design of filterinotify	13 years ago
Yaroslav Halchenko	d9248a6cf8	BF+RF: pyinotify refreshes watcher upon CREATE, unified/simplified (add\|del)LogPath among Filters * all of the Filters had too much of common logic in their LogPath methods, which is now handled by FileFilter and derived classes only add custom actions in corresponding _(add\|del)LogPath methods pyinotify: * upon CREATE event: - unknown files should not be handled at all - "watcher" for the monitored files should be recreated. Lead to adding _(add\|del)FileWatcher helper methods * callback now obtains full event to judge what to do	13 years ago
Leonardo Chiquitto	a7d47e8b36	Update Free Software Foundation's address The address has changed from "59 Temple Place, Suite 330, Boston, MA 02111-1307 USA" to "51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA" some time ago.	13 years ago
Yaroslav Halchenko	ed6daa70bf	ENH: modelines for emacs and vim to assure consistent indentation scheme (tabs)	13 years ago
Cyril Jaquier	8da2fe515a	- Added and changed some logging level and messages. git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@696 a942ae1a-1317-0410-a47c-b1dcaea8d605	17 years ago
Cyril Jaquier	d645a8fe47	- Process failtickets as long as failmanager is not empty. git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@676 a942ae1a-1317-0410-a47c-b1dcaea8d605	17 years ago
Cyril Jaquier	bcdb428e1b	- Added missing argument. - Fixed use of FileContainer in filterpoll.py. git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@649 a942ae1a-1317-0410-a47c-b1dcaea8d605	17 years ago
Cyril Jaquier	695b6b1fe5	- New log rotation detection algorithm. - Print monitored files in status. git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@644 a942ae1a-1317-0410-a47c-b1dcaea8d605	17 years ago
Cyril Jaquier	65dcbed591	- Split Filter into Filter and FileFilter. git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@641 a942ae1a-1317-0410-a47c-b1dcaea8d605	17 years ago
Cyril Jaquier	090518ddaf	- Fixed "reload" bug. Many many thanks to Yaroslav Halchenko git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@567 a942ae1a-1317-0410-a47c-b1dcaea8d605	18 years ago
Cyril Jaquier	fddce1cbdc	- Clean up resources. Does not seem to free resources correctly. Gamin bug??? git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@564 a942ae1a-1317-0410-a47c-b1dcaea8d605	18 years ago
Cyril Jaquier	7659452ade	- Refactoring git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@451 a942ae1a-1317-0410-a47c-b1dcaea8d605	18 years ago
Cyril Jaquier	af41290fc6	- Added the class MyTime. Replaces call to time.time() and time.gmtime(). A fixed time value can be set for testing purpose git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@418 a942ae1a-1317-0410-a47c-b1dcaea8d605	18 years ago
Cyril Jaquier	4502c0f6ba	- Organized imports (pylint) git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@382 a942ae1a-1317-0410-a47c-b1dcaea8d605	18 years ago
Cyril Jaquier	6ab1d13234	- Fixed log rotation bug - Refactoring git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@376 a942ae1a-1317-0410-a47c-b1dcaea8d605	18 years ago
Cyril Jaquier	4b80546f10	- Fixed bugs introduced by refactoring git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@369 a942ae1a-1317-0410-a47c-b1dcaea8d605	18 years ago
Cyril Jaquier	126807dea8	- Made private fields prefixed with "__" git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@368 a942ae1a-1317-0410-a47c-b1dcaea8d605	18 years ago
Cyril Jaquier	bd2b94cc84	- Added smmmaaallll comment git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@358 a942ae1a-1317-0410-a47c-b1dcaea8d605	18 years ago
Cyril Jaquier	7f7361a282	- Added Gamin (file and directory monitoring system) support - If Gamin is not available, polling is used git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@355 a942ae1a-1317-0410-a47c-b1dcaea8d605	18 years ago

20 Commits (cbed57bffd4aedd9fa1aba0ac6098aaba22bff2c)