From owner-freebsd-ports@FreeBSD.ORG Thu Jan 26 15:56:16 2012 Return-Path: Delivered-To: ports@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 31C45106564A for ; Thu, 26 Jan 2012 15:56:16 +0000 (UTC) (envelope-from scheidell@freebsd.org) Received: from mx1.secnap.com.ionspam.net (mx1.secnap.com.ionspam.net [204.89.241.253]) by mx1.freebsd.org (Postfix) with ESMTP id 00F358FC12 for ; Thu, 26 Jan 2012 15:56:15 +0000 (UTC) Received: from mx1.secnap.com.ionspam.net (mx1.secnap.com.ionspam.net [10.70.1.253]) by mx1.secnap.com.ionspam.net (Postfix) with ESMTP id 88824621C3B for ; Thu, 26 Jan 2012 10:56:15 -0500 (EST) X-Virus-Scanned: SpammerTrap(r) VPS-1500 2.17 at mx1.secnap.com.ionspam.net Received: from USBCTDC001.secnap.com (usbctdc001.secnap.com [10.70.1.1]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by mx1.secnap.com.ionspam.net (Postfix) with ESMTPS id E3C43621C05 for ; Thu, 26 Jan 2012 10:56:14 -0500 (EST) Received: from macintosh.secnap.com (10.70.3.3) by USBCTDC001.secnap.com (10.70.1.1) with Microsoft SMTP Server (TLS) id 14.0.722.0; Thu, 26 Jan 2012 10:56:14 -0500 Message-ID: <4F21779E.1070504@freebsd.org> Date: Thu, 26 Jan 2012 10:56:14 -0500 From: Michael Scheidell Organization: SECNAP Network Security Corp User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.20) Gecko/20110804 Thunderbird/3.1.12 MIME-Version: 1.0 To: Content-Type: text/plain; charset="ISO-8859-1"; format=flowed Content-Transfer-Encoding: 7bit Cc: Subject: Stop me before I violate DougBBSD rules for rc scripts: X-BeenThere: freebsd-ports@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Porting software to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 26 Jan 2012 15:56:16 -0000 so, this hack is ugly. and I have been trying to track this down for YEARS. swatch will (every now and then, some patch, some os upgrade, some ARCH), will mash the $0 line and then rc.script can't status or stop it. Good: /swatch start Starting swatch. scanner.secnap.net# ps -auxww | grep swatch root 85713 0.0 0.7 7496 6952 ?? Ss 9:29AM 0:00.00 /usr/local/bin/swatch -c /usr/local/etc/swatch-hackertrap.conf --tail-file=/var/log/eventlog --tail-args=-Fn0 --daemon --script-dir=/tmp/ --pid-file=/var/run/swatch_1.pid (perl) ./swatch status watch is running as pid 85713. bad: grep swatch /etc/rc.conf.local swatch_rules="1" swatch_1_flags='-c /usr/local/etc/swatch-hackertrap.conf --tail-file=/var/log/eventlog_this_is_an_incredable_log_file_that_should_cause_big_problems_yes_an_op_would_never_do_this_but_it_is_so_I_can_test_if_problem_is_log_file_arg_or_log_cmd_arg_or_a_lot_of_files_or_some_thing_in_between_and_or.log --tail-args=-Fn0 --daemon --script-dir=/tmp/ --pid-file=/var/run/swatch_1.pid' swatch_enable="YES" ./swatch start ./swatch status swatch is not running. ps -auxww | grep swatch root 86920 0.0 0.7 7496 6960 ?? Is 9:33AM 0:00.01 /usr/local/bin/perl /tmp//.swatch_script.86918 I have tracked it down to the length of $0. if $0 > 222 bytes, 'bad' happens. this is the patch to rc script. note, various times and various pr's people have reported swatch status not working, and put in, and took out procname. (depending on if they had long _flags I suppose) Index: swatch.in =================================================================== RCS file: /home/pcvs/ports/security/swatch/files/swatch.in,v retrieving revision 1.7 diff -u -r1.7 swatch.in --- swatch.in 14 Jan 2012 08:56:53 -0000 1.7 +++ swatch.in 26 Jan 2012 15:54:25 -0000 @@ -21,15 +21,20 @@ name=swatch rcvar=swatch_enable +# set some defaults +: ${swatch_enable="NO"} command=%%PREFIX%%/bin/swatch -procname=%%LOCALBASE%%/bin/perl load_rc_config ${name} if [ -n "${swatch_rules}" ]; then for i in ${swatch_rules}; do eval swatch_flags=\$swatch_${i}_flags + len=`echo $swatch_flags | wc -c` + if [ $len -gt 222 ];then + procname=%%LOCALBASE%%/bin/perl + fi eval swatch_user=\$swatch_${i}_user eval swatch_chdir=\$swatch_${i}_chdir eval pidfile=\$swatch_${i}_pidfile -- Michael Scheidell, CTO o: 561-999-5000 d: 561-948-2259 >*| *SECNAP Network Security Corporation * Best Mobile Solutions Product of 2011 * Best Intrusion Prevention Product * Hot Company Finalist 2011 * Best Email Security Product * Certified SNORT Integrator