Audit log: Failed to lock global mutex: Permission denied

[rcbarnett-zz]

MODSEC-306: When running both Mod Security and Mod Ruid 2, my Mod Security audit log fills up with the following error 'Audit log: Failed to lock global mutex: Permission denied'.

[rcbarnett-zz]

Original reporter: littleb

[rcbarnett-zz]

littleb: I made an error and listed 2.5.6 as the mod_security version.The correct version is 2.6.3.

[rcbarnett-zz]

bpinto: Hello Chris,

Could you send the necessary configuration options to reproduce the issue ?
I would like to make some tests and see if mod_security can work together with mod_ruid2.

Thanks

[rcbarnett-zz]

tomdchi: I am having the same problem.
Environment:
CENTOS 6.3
Apache 2.2.23
mod_ruid2
DSO handler
WHM 11.34.0 (build 11)
PHP 5.4.9
CSF firewall

This error happens when using ownCloud file sharing software from owncloud.org and using the sync client to sync files. It also triggers the CSF firewall to block the IP address. I have a similar setup that does not use mod_ruid2 and do not have this problem with the ownCloud software. The other difference on the second server is that it uses suphp as the Apache handler.

[rcbarnett-zz]

tomdchi: modsec rules that are being used.

[rcbarnett-zz]

arondeparon: I am having the exact same issue with a similar configuration.

[rcbarnett-zz]

jazz: Debian 2.6.39
Apache 2.2
PHP 5.3
mod_security v2.7.2

The same problem.

[rcbarnett-zz]

eagle1: Same here with MPM-ITK on Debian, with Apache 2.2, PHP5.3 (dotdeb) anche mod_security2 from backports.

[alex-leonhardt]

hi,

same here using nginx 1.4.2 with modsecurity-apache_2.7.5 - if I use Concurrent logging, it seems to work, however, then the nginx workers are being killed (there was a previous bug)

Alex

[paulie51]

I'm getting this on Nginx 1.5 modsec 2.7.5 and owncloud. I don't believe the specific rule is relevant to the problem, but here you go :

--aebe1c6a-A--
[05/Dec/2013:15:06:12 +0000] AIAcAcAcAcAcUcAcALAcAc7c my.ip.ad.dr 49304 127.0.0.1 80
--aebe1c6a-B--
PROPFIND /remote.php/webdav HTTP/1.1
User-Agent: Mozilla/5.0 (Linux) csyncoC/0.90.4 neon/0.30.0
Connection: TE
TE: trailers
Host: my.doma.in
Proxy-Connection: Keep-Alive
Depth: 1
Content-Length: 206
Content-Type: application/xml
Cookie: 5263b0ecd7359=gseioa8k7tkba6oirkchrcdv81;

--aebe1c6a-F--
HTTP/1.1 207 Multi-Status
Strict-Transport-Security: max-age=0
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
Pragma: no-cache
Vary: Brief,Prefer
DAV: 1, 3, extended-mkcol, 2
Content-Type: application/xml; charset=utf-8; charset=utf-8+
Content-Length: 875
Connection: keep-alive

--aebe1c6a-E--

--aebe1c6a-H--
Message: Warning. Match of "within %{tx.allowed_methods}" against "REQUEST_METHOD" required. [file "/etc/mod_security/activated_rules/modsecurity_crs_30_http_policy.conf"] [line "31"] [id "960032"] [rev "2"] [msg "Method is not allowed by policy"] [data "PROPFIND"] [severity "CRITICAL"] [ver "OWASP_CRS/2.2.7"] [maturity "9"] [accuracy "9"] [tag "OWASP_CRS/POLICY/METHOD_NOT_ALLOWED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A6"] [tag "OWASP_AppSensor/RE1"] [tag "PCI/12.1"]
Message: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/mod_security/activated_rules/modsecurity_crs_21_protocol_anomalies.conf"] [line "47"] [id "960015"] [rev "1"] [msg "Request Missing an Accept Header"] [severity "NOTICE"] [ver "OWASP_CRS/2.2.7"] [maturity "9"] [accuracy "9"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_ACCEPT"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"]
Message: Warning. Operator LT matched 5 at TX:inbound_anomaly_score. [file "/etc/mod_security/activated_rules/modsecurity_crs_60_correlation.conf"] [line "33"] [id "981203"] [msg "Inbound Anomaly Score (Total Inbound Score: 3, SQLi=, XSS=): Method is not allowed by policy"]
Message: Audit log: Failed to lock global mutex: Permission denied
Apache-Handler: IIS
Stopwatch: 1386255971000859 1022405 (- - -)
Stopwatch2: 1386255971000859 1022405; combined=33261, p1=4314, p2=26648, p3=14, p4=1680, p5=605, sr=82, sw=0, l=0, gc=0
Response-Body-Transformed: Dechunked
Producer: ModSecurity for nginx (STABLE)/2.7.5 (http://www.modsecurity.org/); OWASP_CRS/2.2.7.
Server: ModSecurity Standalone
Engine-Mode: "DETECTION_ONLY"

--aebe1c6a-Z--

Obviously owncloud falls foul of the CRS rules, but I'm intrigued by the mutex error as it may help me to identify why I don't have any persistency (IP, USER, presumably SESSION as well) under Nginx.

Off to disable the offending rule (which will probably take me some hours!).

Paul.

[shawnholt]

same here - running mod_itk

[wellumies]

Still getting this error with serial logging. Is it safe to use serial logging at all?

2014/03/31 12:43:43 [notice] 12335#0: ModSecurity for nginx (STABLE)/2.7.7 (http://www.modsecurity.org/) configured.
2014/03/31 12:43:43 [notice] 12335#0: ModSecurity: APR compiled version="1.4.6"; loaded version="1.4.6"
2014/03/31 12:43:43 [notice] 12335#0: ModSecurity: PCRE compiled version="8.30 "; loaded version="8.30 2012-02-04"
2014/03/31 12:43:43 [notice] 12335#0: ModSecurity: LIBXML compiled version="2.8.0"
2014/03/31 12:44:04 [error] 12338#0: [client xxx.xxx.xxx.xxx] ModSecurity: Audit log: Failed to lock global mutex: Permission denied [hostname ""] [uri "/nginx_stub_status"] [unique_id "AcGPArAlAcAcAcAEtOAcAcAc"]
2014/03/31 12:44:04 [error] 12338#0: [client xxx.xxx.xxx.xxx] ModSecurity: Audit log: Failed to unlock global mutex: Permission denied [hostname ""] [uri "/nginx_stub_status"] [unique_id "AcGPArAlAcAcAcAEtOAcAcAc"]
2014/03/31 12:45:04 [error] 12338#0: [client xxx.xxx.xxx.xxx] ModSecurity: Audit log: Failed to lock global mutex: Permission denied [hostname ""] [uri "/nginx_stub_status"] [unique_id "AcAcAcUcAcASAcAcAcAcA@Ac"]
2014/03/31 12:45:04 [error] 12338#0: [client xxx.xxx.xxx.xxx] ModSecurity: Audit log: Failed to unlock global mutex: Permission denied [hostname ""] [uri "/nginx_stub_status"] [unique_id "AcAcAcUcAcASAcAcAcAcA@Ac"]
2014/03/31 12:46:04 [error] 12338#0: [client xxx.xxx.xxx.xxx] ModSecurity: Audit log: Failed to lock global mutex: Permission denied [hostname ""] [uri "/nginx_stub_status"] [unique_id "AIcEAcA0Kc3cAcAcAcA6Acdc"]
2014/03/31 12:46:04 [error] 12338#0: [client xxx.xxx.xxx.xxx] ModSecurity: Audit log: Failed to unlock global mutex: Permission denied [hostname ""] [uri "/nginx_stub_status"] [unique_id "AIcEAcA0Kc3cAcAcAcA6Acdc"]
2014/03/31 12:47:04 [error] 12338#0: [client xxx.xxx.xxx.xxx] ModSecurity: Audit log: Failed to lock global mutex: Permission denied [hostname ""] [uri "/nginx_stub_status"] [unique_id "AYAcAcAcAcAcAcAcAcAcAiAm"]
2014/03/31 12:47:04 [error] 12338#0: [client xxx.xxx.xxx.xxx] ModSecurity: Audit log: Failed to unlock global mutex: Permission denied [hostname ""] [uri "/nginx_stub_status"] [unique_id "AYAcAcAcAcAcAcAcAcAcAiAm"]
2014/03/31 12:48:04 [error] 12338#0: [client xxx.xxx.xxx.xxx] ModSecurity: Audit log: Failed to lock global mutex: Permission denied [hostname ""] [uri "/nginx_stub_status"] [unique_id "AcAcAcAcAck9rcAciVAcAcAQ"]
2014/03/31 12:48:04 [error] 12338#0: [client xxx.xxx.xxx.xxx] ModSecurity: Audit log: Failed to unlock global mutex: Permission denied [hostname ""] [uri "/nginx_stub_status"] [unique_id "AcAcAcAcAck9rcAciVAcAcAQ"]
2014/03/31 12:49:04 [error] 12338#0: [client xxx.xxx.xxx.xxx] ModSecurity: Audit log: Failed to lock global mutex: Permission denied [hostname ""] [uri "/nginx_stub_status"] [unique_id "AZAyACAcAuAcAcAcAlrwAcAf"]
2014/03/31 12:49:04 [error] 12338#0: [client xxx.xxx.xxx.xxx] ModSecurity: Audit log: Failed to unlock global mutex: Permission denied [hostname ""] [uri "/nginx_stub_status"] [unique_id "AZAyACAcAuAcAcAcAlrwAcAf"]
2014/03/31 12:50:04 [error] 12338#0: [client xxx.xxx.xxx.xxx] ModSecurity: Audit log: Failed to lock global mutex: Permission denied [hostname ""] [uri "/nginx_stub_status"] [unique_id "AcAcAcNcDcQcAcAcAmfcAcAc"]
2014/03/31 12:50:04 [error] 12338#0: [client xxx.xxx.xxx.xxx] ModSecurity: Audit log: Failed to unlock global mutex: Permission denied [hostname ""] [uri "/nginx_stub_status"] [unique_id "AcAcAcNcDcQcAcAcAmfcAcAc"]

[ataliba]

Same here using the mpm itk on CentOS 6 .

mod_security-2.7.3-3.el6.x86_64
httpd-itk-2.2.22-6.el6.x86_64
CentOS release 6.5 (Final)