Debian Bug report logs - #668597
php5 creates weird files in /

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Ulf Hermann <ulfhermann@kulturserver.de>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: php5 creates weird files in /

Date: Fri, 13 Apr 2012 10:00:55 +0000

Package: php5
Version: 5.3.3-7+squeeze8
Severity: normal


Today I found the following files in /

root@devs:~# ls /
??????  ??????  bin   ?<??d?  data  etc   ?h?u??      ?L?ƥ?  lib64       media  opt     proc  sbin     srv  tmp     ???u??  usr  vmlinuz
?ʺ???   ?;??    boot  ??:?d?  dev   home  initrd.img  lib    lost+found  mnt    P?????  root  selinux  sys  ???u??  ???u??  var  ?w?ƥ?
root@

After renaming them I found the following contents:

root@devs:/# cat baum*
[11-Mar-2012 06:25:06] PHP Deprecated:  Comments starting with '#' are
deprecated in /etc/php5/apache2/conf.d/apc.ini on line 1 in Unknown on
line 0
[25-Mar-2012 06:25:06] PHP Deprecated:  Comments starting with '#' are
deprecated in /etc/php5/apache2/conf.d/apc.ini on line 1 in Unknown on
line 0
[01-Apr-2012 06:25:06] PHP Deprecated:  Comments starting with '#' are
deprecated in /etc/php5/apache2/conf.d/apc.ini on line 1 in Unknown on
line 0
[...]

As only php is reading and interpreting /etc/php5/apache2/conf.d/apc.ini that makes me suspect a bug in PHP here.

-- System Information:
Debian Release: 6.0.4
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 2.6.32-5-amd64 (SMP w/1 CPU core)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages php5 depends on:
ii  libapache2-mod-php5     5.3.3-7+squeeze8 server-side, HTML-embedded scripti
ii  php5-common             5.3.3-7+squeeze8 Common files for packages built fr

php5 recommends no packages.

php5 suggests no packages.

-- no debconf information

Message #10 received at 668597@bugs.debian.org (full text, mbox, reply):

From: Ondřej Surý <ondrej@debian.org>

To: Ulf Hermann <ulfhermann@kulturserver.de>, 668597@bugs.debian.org

Subject: Re: [php-maint] Bug#668597: php5 creates weird files in /

Date: Fri, 13 Apr 2012 13:00:09 +0200

Hi Ulf,

I don't think the PHP is here at fault. I looks like some script is
calling php (maybe a cron job?) and redirecting output to a random
files in root directory.

Ondrej

On Fri, Apr 13, 2012 at 12:00, Ulf Hermann <ulfhermann@kulturserver.de> wrote:
> Package: php5
> Version: 5.3.3-7+squeeze8
> Severity: normal
>
>
> Today I found the following files in /
>
> root@devs:~# ls /
> ??????  ??????  bin   ?<??d?  data  etc   ?h?u??      ?L?ƥ?  lib64       media  opt     proc  sbin     srv  tmp     ???u??  usr  vmlinuz
> ?ʺ???   ?;??    boot  ??:?d?  dev   home  initrd.img  lib    lost+found  mnt    P?????  root  selinux  sys  ???u??  ???u??  var  ?w?ƥ?
> root@
>
> After renaming them I found the following contents:
>
> root@devs:/# cat baum*
> [11-Mar-2012 06:25:06] PHP Deprecated:  Comments starting with '#' are
> deprecated in /etc/php5/apache2/conf.d/apc.ini on line 1 in Unknown on
> line 0
> [25-Mar-2012 06:25:06] PHP Deprecated:  Comments starting with '#' are
> deprecated in /etc/php5/apache2/conf.d/apc.ini on line 1 in Unknown on
> line 0
> [01-Apr-2012 06:25:06] PHP Deprecated:  Comments starting with '#' are
> deprecated in /etc/php5/apache2/conf.d/apc.ini on line 1 in Unknown on
> line 0
> [...]
>
> As only php is reading and interpreting /etc/php5/apache2/conf.d/apc.ini that makes me suspect a bug in PHP here.
>
> -- System Information:
> Debian Release: 6.0.4
>  APT prefers stable
>  APT policy: (500, 'stable')
> Architecture: amd64 (x86_64)
>
> Kernel: Linux 2.6.32-5-amd64 (SMP w/1 CPU core)
> Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
> Shell: /bin/sh linked to /bin/dash
>
> Versions of packages php5 depends on:
> ii  libapache2-mod-php5     5.3.3-7+squeeze8 server-side, HTML-embedded scripti
> ii  php5-common             5.3.3-7+squeeze8 Common files for packages built fr
>
> php5 recommends no packages.
>
> php5 suggests no packages.
>
> -- no debconf information
>
>
>
> _______________________________________________
> pkg-php-maint mailing list
> pkg-php-maint@lists.alioth.debian.org
> http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-php-maint



-- 
Ondřej Surý <ondrej@sury.org>

Message #17 received at 668597@bugs.debian.org (full text, mbox, reply):

From: Ulf Hermann <ulfhermann@kulturserver.de>

To: Ondřej Surý <ondrej@debian.org>

Cc: 668597@bugs.debian.org

Subject: Re: [php-maint] Bug#668597: php5 creates weird files in /

Date: Fri, 13 Apr 2012 13:20:14 +0200

>
> I don't think the PHP is here at fault. I looks like some script is
> calling php (maybe a cron job?) and redirecting output to a random
> files in root directory.

It has an interesting correlation with logrotate as most (but not all)
of the files were created when apache logs were rotated and the
logrotate script indeed reloads the apache config:

root@devs:~# cat /etc/logrotate.d/apache2
/var/log/apache2/*.log {
        weekly
        missingok
        rotate 52
        compress
        delaycompress
        notifempty
        create 640 root adm
        sharedscripts
        postrotate
                /etc/init.d/apache2 reload > /dev/null
        endscript
}

However, I can't really see why this should spit out random files in / .
All other cron jobs seem unrelated.

Ulf

Message #20 received at 668597@bugs.debian.org (full text, mbox, reply):

From: Bob Proulx <bob@proulx.com>

To: Ulf Hermann <ulfhermann@kulturserver.de>, 668597@bugs.debian.org

Subject: Re: Bug#668597: php5 creates weird files in /

Date: Fri, 13 Apr 2012 10:25:45 -0600

Ulf Hermann wrote:
> ???  ???  bin   ?<??d?  data  etc   ?h?u??      ?L?ƥ?  lib64       media  opt
>   proc  sbin     srv  tmp     ???u??  usr  vmlinuz
> ?ʺ???   ?;??    boot  ??:?d?  dev   home  initrd.img  lib    lost+found  mnt
> P???  root  selinux  sys  ???u??  ???u??  var  ?w?ƥ?

What were the timestamps on those files that you found in / from this
event?  Were they current with a similar timestamp to the messages
you share below?  Or were they much older?  Could this have been
something that happened a long time ago?  Or is this something that
is continuing to happen daily?

> [11-Mar-2012 06:25:06] PHP Deprecated:  Comments starting with '#' are deprecated in /etc/php5/apache2/conf.d/apc.ini on line 1 in Unknown on line 0
> [25-Mar-2012 06:25:06] PHP Deprecated:  Comments starting with '#' are deprecated in /etc/php5/apache2/conf.d/apc.ini on line 1 in Unknown on line 0
> [01-Apr-2012 06:25:06] PHP Deprecated:  Comments starting with '#' are deprecated in /etc/php5/apache2/conf.d/apc.ini on line 1 in Unknown on line 0
> [...]

The timestamps above show that it has been happening not quite
weekly.  It looks like it skipped a week on the 18th.  But has
otherwise been happening on Sunday.  That could be a clue to find the
cron task that runs weekly on Sunday to find what has been happening.

Those init files are part of the php-apc package.  What is the status
of that package on your system?  Is it installed or removed?

  dpkg -l php-apc

> As only php is reading and interpreting /etc/php5/apache2/conf.d/apc.ini that makes me suspect a bug in PHP here.

I have two suspicions.  One is that an older version of the php-apc
package may have been installed at one time and then subsequently
removed but not purged leaving the conffiles in /etc around.  I
suspect that there may be something in those left behind files that
are interacting.  My second is that there is a cron task script that
we are not seeing that is perhaps a local script not from any package
that is causing this.

Could you look through the cron scripts that run weekly and try to
find what might be running at that time?

Bob

Message #25 received at 668597@bugs.debian.org (full text, mbox, reply):

From: Ulf Hermann <ulfhermann@kulturserver.de>

To: Bob Proulx <bob@proulx.com>

Cc: 668597@bugs.debian.org

Subject: Re: Bug#668597: php5 creates weird files in /

Date: Fri, 13 Apr 2012 18:46:01 +0200

[Message part 1 (text/plain, inline)]

> What were the timestamps on those files that you found in / from this
> event?  Were they current with a similar timestamp to the messages
> you share below?  Or were they much older?  Could this have been
> something that happened a long time ago?  Or is this something that
> is continuing to happen daily?
>   

I'll just attach all of those files (renamed, though, and in no
particular order), then you can see for yourself. It didn't happen every
sunday, but almost and some are on other times. The sunday thing
correlates with the logrotate cronjob I posted before. There's no other
cronjob running in the daily schedule (at 6:25), but only ever does
anything on sunday. The files contain the deprecation messages.

> The timestamps above show that it has been happening not quite
> weekly.  It looks like it skipped a week on the 18th.  But has
> otherwise been happening on Sunday.  That could be a clue to find the
> cron task that runs weekly on Sunday to find what has been happening.
>
> Those init files are part of the php-apc package.  What is the status
> of that package on your system?  Is it installed or removed?
>
>   dpkg -l php-apc
>   

It's installed, but disabled via the deprecated '#' in
/etc/php5/apache2/conf.d/apc.ini the message is complaining about:

ii  php-apc                                            
3.1.3p1-2                                           APC (Alternative PHP
Cache) module for PHP 5

> Could you look through the cron scripts that run weekly and try to
> find what might be running at that time?
>   

I already did that. The regular weekly scripts run at 6:47, only daily
scripts run at 6:25. Of those only the apache logrotate has that
behavior of only actually doing anything on sunday. So maybe it's a
logrotate issue after all. Maybe logrotate cannot handle error messages
from postrotate scripts. However, that wouldn't explain the occurences
on non-sundays.

Ulf

[bug.tar.gz (application/x-gzip, attachment)]

Message #30 received at 668597@bugs.debian.org (full text, mbox, reply):

From: Ondřej Surý <ondrej@debian.org>

To: Ulf Hermann <ulfhermann@kulturserver.de>, 668597@bugs.debian.org

Subject: Re: [php-maint] Bug#668597: php5 creates weird files in /

Date: Tue, 22 May 2012 09:26:37 +0200

Hi Ulf,

last shot - is your filesystem health ok?

I don't think this is a bug in the php5 itself, but a manifestation of
some other problem on your system.

O.

On Fri, Apr 13, 2012 at 12:00 PM, Ulf Hermann
<ulfhermann@kulturserver.de> wrote:
> Package: php5
> Version: 5.3.3-7+squeeze8
> Severity: normal
>
>
> Today I found the following files in /
>
> root@devs:~# ls /
> ??????  ??????  bin   ?<??d?  data  etc   ?h?u??      ?L?ƥ?  lib64       media  opt     proc  sbin     srv  tmp     ???u??  usr  vmlinuz
> ?ʺ???   ?;??    boot  ??:?d?  dev   home  initrd.img  lib    lost+found  mnt    P?????  root  selinux  sys  ???u??  ???u??  var  ?w?ƥ?
> root@
>
> After renaming them I found the following contents:
>
> root@devs:/# cat baum*
> [11-Mar-2012 06:25:06] PHP Deprecated:  Comments starting with '#' are
> deprecated in /etc/php5/apache2/conf.d/apc.ini on line 1 in Unknown on
> line 0
> [25-Mar-2012 06:25:06] PHP Deprecated:  Comments starting with '#' are
> deprecated in /etc/php5/apache2/conf.d/apc.ini on line 1 in Unknown on
> line 0
> [01-Apr-2012 06:25:06] PHP Deprecated:  Comments starting with '#' are
> deprecated in /etc/php5/apache2/conf.d/apc.ini on line 1 in Unknown on
> line 0
> [...]
>
> As only php is reading and interpreting /etc/php5/apache2/conf.d/apc.ini that makes me suspect a bug in PHP here.
>
> -- System Information:
> Debian Release: 6.0.4
>  APT prefers stable
>  APT policy: (500, 'stable')
> Architecture: amd64 (x86_64)
>
> Kernel: Linux 2.6.32-5-amd64 (SMP w/1 CPU core)
> Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
> Shell: /bin/sh linked to /bin/dash
>
> Versions of packages php5 depends on:
> ii  libapache2-mod-php5     5.3.3-7+squeeze8 server-side, HTML-embedded scripti
> ii  php5-common             5.3.3-7+squeeze8 Common files for packages built fr
>
> php5 recommends no packages.
>
> php5 suggests no packages.
>
> -- no debconf information
>
>
>
> _______________________________________________
> pkg-php-maint mailing list
> pkg-php-maint@lists.alioth.debian.org
> http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-php-maint



-- 
Ondřej Surý <ondrej@sury.org>

Message #35 received at 668597@bugs.debian.org (full text, mbox, reply):

From: Ulf Hermann <ulfhermann@kulturserver.de>

To: Ondřej Surý <ondrej@debian.org>

Cc: 668597@bugs.debian.org

Subject: Re: [php-maint] Bug#668597: php5 creates weird files in /

Date: Tue, 22 May 2012 09:50:46 +0200

> last shot - is your filesystem health ok?
>   

It happens on two virtual machines running on the same host server.
They're similar but it seems unlikely that they'd suddenly both develop
the same defect in their file systems. Obviously the problem is that PHP
doesn't know where to put its logs when parsing that deprecated '#'.
Then it probably uses some uninitialized data as file name, opens the
file associated with that and puts them there. This is nasty. Someone
could make the OS allocate a big chunk of memory and repeatedly write
'/etc/passwd', then deallocate it and wait for the OS to give some part
of that chunk to PHP. Chances are that it would overwrite /etc/passwd
then. I have specified a file as error_log in /etc/php5/apache2/php.ini
and it seems to ignore it:

error_log = "/var/log/php_error.log"

Should it write those things to the error log? Or where would they
normally end up? I'll do some more experiments tonight. Please don't
close the bug, yet.

Message #40 received at 668597@bugs.debian.org (full text, mbox, reply):

From: Ulf Hermann <ulfhermann@kulturserver.de>

To: Ondřej Surý <ondrej@debian.org>

Cc: 668597@bugs.debian.org

Subject: Re: [php-maint] Bug#668597: php5 creates weird files in /

Date: Tue, 22 May 2012 23:12:40 +0200

The effect is perfectly reproducible, but only on those two systems.
Even with the exact same apache and php configs I cannot reproduce the
effect on a third computer, though. Unfortunately I cannot recreate the
exact same set of packages there at the moment. Steps are as follows:

1. Change the comment sign to '#' in /etc/php5/apache2/conf.d/apc.ini
2. Do "/etc/init.d/apache2 reload" (not "restart")

Then the file appears and the following lines show up in
/var/log/apache2/error.log

[Tue May 22 20:51:32 2012] [notice] Graceful restart requested, doing
restart
[Tue May 22 20:51:32 2012] [error] (9)Bad file descriptor:
apr_socket_accept: (client socket)
[Tue May 22 20:51:32 2012] [notice] Apache/2.2.16 (Debian)
mod_ssl/2.2.16 OpenSSL/0.9.8o configured -- resuming normal operations

That is interesting. When I do a "restart" the strange file is not
created and instead those lines show up there:

Tue May 22 20:52:57 2012] [notice] caught SIGTERM, shutting down
PHP Deprecated:  Comments starting with '#' are deprecated in
/etc/php5/apache2/conf.d/apc.ini on line 1 in Unknown on line 0
[Tue May 22 20:52:58 2012] [notice] Apache/2.2.16 (Debian)
mod_ssl/2.2.16 OpenSSL/0.9.8o configured -- resuming normal operations

The problem might have something to do with this:
https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/174805 - at least
it creates the same error message. The third computer where it doesn't
happen also listens on ports 80 and 443, though. And I don't see any
hung processes anywhere.

Message #45 received at 668597-done@bugs.debian.org (full text, mbox, reply):

From: Ondřej Surý <ondrej@sury.org>

To: 648424-done@bugs.debian.org, 636146-done@bugs.debian.org, 637212-done@bugs.debian.org, 645340-done@bugs.debian.org, 647475-done@bugs.debian.org, 668157-done@bugs.debian.org, 668928-done@bugs.debian.org, 684110-done@bugs.debian.org, 691917-done@bugs.debian.org, 703109-done@bugs.debian.org, 705350-done@bugs.debian.org, 706091-done@bugs.debian.org, 715513-done@bugs.debian.org, 724817-done@bugs.debian.org, 668597-done@bugs.debian.org, 612364-done@bugs.debian.org, 507401-done@bugs.debian.org, 674685-done@bugs.debian.org, 499031-done@bugs.debian.org, 580232-done@bugs.debian.org, 674476-done@bugs.debian.org

Subject: Closing bugs filled against php5 in oldstable

Date: Fri, 04 Jul 2014 14:09:04 +0200

Version: 5.4.4-14

Hey all,

I am closing the bugs that were filled against php5 5.3 in Debian
oldstable
(well and earlier)...

Feel free to reopen the bug in you can reproduce it with php5 from
current
stable Debian release.

Cheers,
-- 
Ondřej Surý <ondrej@sury.org>
Knot DNS (https://www.knot-dns.cz/) – a high-performance DNS server

Send a report that this bug log contains spam.