I have a newly installed CentOS 7 server, running Apache httpd 2.4.6 and I just noticed that its audit logs grow too fast, with lots of entries like this one:
type=ANOM_ABEND msg=audit(06/02/15 15:44:09.341:906003) : auid=unset uid=apache gid=apache ses=unset subj=system_u:system_r:httpd_t:s0 pid=44258 comm=httpd reason="memory violation" sig=SIGSEGV
Attaching the debugger to a random apache child process and waiting for it to crash gives this:
Program received signal SIGSEGV, Segmentation fault. 0x00007f8433bf47f8 in main_arena () from /lib64/libc.so.6 (gdb) backtrace #0 0x00007f8433bf47f8 in main_arena () from /lib64/libc.so.6 #1 0x00007f8428e4de43 in ssl_hook_Access () from /etc/httpd/modules/mod_ssl.so #2 0x00007f8435370490 in ap_run_access_checker () #3 0x00007f8435372d75 in ap_process_request_internal () #4 0x00007f843538dbe0 in ap_internal_redirect () #5 0x00007f843538e074 in ap_process_async_request () #6 0x00007f843538e404 in ap_process_request () #7 0x00007f843538adb2 in ap_process_http_connection () #8 0x00007f8435382e30 in ap_run_process_connection () #9 0x00007f842acdc7ef in child_main () from /etc/httpd/modules/mod_mpm_prefork.so #10 0x00007f842acdca26 in make_child () from /etc/httpd/modules/mod_mpm_prefork.so #11 0x00007f842acdd6be in prefork_run () from /etc/httpd/modules/mod_mpm_prefork.so #12 0x00007f84353600fe in ap_run_mpm () #13 0x00007f8435359726 in main ()
It seems it is caused by mod_ssl. Looking at the httpd logs, I can correlate the following events from different logfiles:
[Fri Feb 06 15:44:09.343116 2015] [ssl:error] [pid 44258] [client X.X.X.39:29260] AH02225: Re-negotiation request failed [Fri Feb 06 15:44:09.343167 2015] [ssl:error] [pid 44258] SSL Library Error: error:14080152:SSL routines:SSL3_ACCEPT:unsafe legacy renegotiation disabled
[Fri Feb 06 15:44:10.147381 2015] [core:notice] [pid 2689] AH00052: child pid 44258 exit signal Segmentation fault (11)
So, on one hand, I don't want to allow unsafe SSL renegotiation in Apache httpd. But I'm getting one or two errors like these each second, which translates into 3 lines of log in the apache logs, 1 line in the audit log and well, an apache child process crashing.
Is it possible to prevent these processes from crashing? Just because the unsafe legacy renegotiation is not allowed, does it mean it needs to segfault? Any ideas to improve this situation?
PS: Software versions:
- OpenSSL 1.0.1e-fips 11 Feb 2013
- Server version: Apache/2.4.6 (CentOS); Server built: Jan 12 2015 13:22:31