Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add fix to avoid GLIBC crash #689

Merged
merged 2 commits into from
Jul 7, 2022
Merged

Conversation

fcaffieri
Copy link
Member

Related issue
#1665

Description

Some users have reported problems with Filebeat after installing wazuh related to SIGABRT.
The error it throws is "filebeat[21584]: SIGABRT: abort"
Until now, the error could only be reproduced on systems that have GLIBC v2.35 installed.

After an analysis it was found that the way to solve it is to add the following to the Filebeat template:

seccomp:
  default_action: allow
  syscalls:
  - action: allow
    names:
    - rseq

Tests were performed on all recommended systems and a few more. The tests consisted of trying to reproduce the error and then applying the changes to the Filebeat template. Then check, if the error could be reproduced, it is not generated anymore; and if it couldn't be reproduced, that these changes don't have any other unwanted impact on Filebeat.

Logs example

filebeat[21584]: runtime/cgo: pthread_create failed: Operation not permitted
filebeat[21584]: SIGABRT: abort
filebeat[21584]: PC=0x7f036b9eaa7c m=7 sigcode=18446744073709551610

Tests

Summary of tests:
wazuh/wazuh-packages#1665 (comment)

System test:
wazuh/wazuh-packages#1665 (comment)
wazuh/wazuh-packages#1665 (comment)
wazuh/wazuh-packages#1665 (comment)
wazuh/wazuh-packages#1665 (comment)
wazuh/wazuh-packages#1665 (comment)

@fcaffieri fcaffieri self-assigned this Jul 6, 2022
@fcaffieri fcaffieri requested review from okynos and alberpilot July 6, 2022 20:37
@okynos okynos merged commit 23cb741 into 4.3 Jul 7, 2022
@okynos okynos deleted the 1665-Fix-filebeat-crash-due-to-glibc-to4.3 branch July 7, 2022 06:59
rauldpm pushed a commit that referenced this pull request May 18, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants