1

After a recent upgrade, avahi-daemon is not starting up anymore. Furthermore, the behaviour differs whether if I redirect stderr to a file or not.

If I run avahi with the debugging option (avahi-daemon --debug), I get the following output:

Found user 'avahi' (UID 84) and group 'avahi' (GID 84).
Successfully dropped root privileges.
avahi-daemon 0.6.32 starting up.
Failed to chroot(): Permission denied
chroot.c: chroot() helper started
chroot.c: chroot() helper got command 0d
avahi-daemon 0.6.32 exiting.
chroot.c: chroot() helper got command 0c
chroot.c: chroot() helper exiting with return value 0

If I add stderr IO-redirection (avahi-daemon --debug 2>avahi.stderr), I get different behaviour:

On the terminal (stdout), I get

File size limit exceeded

and avahi.stderr now contains

Found user 'avahi' (UID 84) and group 'avahi' (GID 84).
Successfully dropped root privileges.

But, no avahi-process is running.

When I just redirect 2>/dev/stdin, I get the same behaviour as without redirection.

Corresponding strace-outputs:

strace avahi-daemon --debug:

Due to size limitation in stackexchange, this one is in a pastebin: http://paste.pound-python.org/show/J1sYeeXcKYKlHxN6QAX0/

strace avahi-daemon --debug 2>strace.out (with File size limit exceeded on stdout):

Due to size limitation in stackexchange, that one is in a pastebin: http://paste.pound-python.org/show/VpFokjSr6kmNAA98s4Y6/

And my environment (output of env, my non-root-username has been censored) is this:

Due to size limitation of stackexchange, this one is in a pastebin: http://paste.pound-python.org/show/3s9Qo1WVMB6mLtf15pXp/

Version of avahi: avahi-daemon -V prints avahi-daemon 0.6.32.

About the configuration:

% ls -la /etc | grep avahi
drwx------   3 root     root       4096 Mar  9 13:29 avahi

% ls -la /etc/avahi
drwx------   3 root root  4096 Mar  9 13:29 .
drwxr-xr-x 242 root root 20480 Mar  9 13:29 ..
-rwxr-xr-x   1 root root  2509 Feb 19 13:52 avahi-autoipd.action
-rw-r--r--   1 root root  1747 Feb 19 13:52 avahi-daemon.conf
-rw-r--r--   1 root root  1747 Dec 25 18:22 avahi-daemon.conf.pacnew
lrwxrwxrwx   1 root root    38 Mar  9 13:25 avahi-daemon.conf.pacsave -> /usr/local/etc/avahi/avahi-daemon.conf
-rwxr-xr-x   1 root root  2743 Feb 19 13:52 avahi-dnsconfd.action
-rw-r--r--   1 root root  1121 Feb 19 13:52 hosts
drwx------   2 root root  4096 Mar  9 13:29 services

Well, /usr/local/etc/avahi/avahi-daemon.conf is the configuration I usually use, it has been replaced during update. If I use that configuration, I get the same behaviour, and it doesn't matter if /etc/avahi/avahi-daemon.conf is a regular file in-place or a symlink.

Here, I post the content of /etc/avahi/avahi-daemon.conf as it has been for creating this question:

# This file is part of avahi.
#
# avahi is free software; you can redistribute it and/or modify it
# under the terms of the GNU Lesser General Public License as
# published by the Free Software Foundation; either version 2 of the
# License, or (at your option) any later version.
#
# avahi is distributed in the hope that it will be useful, but WITHOUT
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
# License for more details.
#
# You should have received a copy of the GNU Lesser General Public
# License along with avahi; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
# USA.

# See avahi-daemon.conf(5) for more information on this configuration
# file!

[server]
#host-name=foo
#domain-name=local
#browse-domains=0pointer.de, zeroconf.org
use-ipv4=yes
use-ipv6=yes
#allow-interfaces=eth0
#deny-interfaces=eth1
#check-response-ttl=no
#use-iff-running=no
#enable-dbus=yes
#disallow-other-stacks=no
#allow-point-to-point=no
#cache-entries-max=4096
#clients-max=4096
#objects-per-client-max=1024
#entries-per-entry-group-max=32
ratelimit-interval-usec=1000000
ratelimit-burst=1000

[wide-area]
enable-wide-area=yes

[publish]
#disable-publishing=no
#disable-user-service-publishing=no
#add-service-cookie=no
#publish-addresses=yes
publish-hinfo=no
publish-workstation=no
#publish-domain=yes
#publish-dns-servers=192.168.50.1, 192.168.50.2
#publish-resolv-conf-dns-servers=yes
#publish-aaaa-on-ipv4=yes
#publish-a-on-ipv6=no

[reflector]
#enable-reflector=no
#reflect-ipv=no

[rlimits]
#rlimit-as=
rlimit-core=0
rlimit-data=4194304
rlimit-fsize=0
rlimit-nofile=768
rlimit-stack=4194304
rlimit-nproc=3

I use Arch Linux, with OpenRC (i.e. no systemd), and the behaviour is the same whether I use the package avahi or avahi-nosystemd. I had some problems with avahi before, such that it first did run and then crashed.

What might be going on here?

  • @Rui F Ribeiro: Done. – Golar Ramblar Mar 9 '16 at 13:43
  • Seeing that /etc/avahi/ was only accessible by root, canging the permissions to be accessible for everyone solved that problem. – Golar Ramblar Mar 9 '16 at 13:44
0

The solution:

/etc/avahi/ needs to be accessible by avahi-daemon after it dropped root priviledges.

So, /etc/avahi/ and all subdirectories should have mode 755, and all files mode 644, while they stay owned by user root and group root.

  • 1
    Thanks, Rui F Ribeiro, after thinking about your comment I see (the comprimised process can change the configuration files, for example, such that at the next start it can be started with a modified configuration). – Golar Ramblar Mar 9 '16 at 14:10
0

Related to another mentioned issue, you get a "File size limit exceeded" error from avahi-daemon because it sets its file size rlimit to 0 in its configuration, and your redirection to a file creates a file with a size larger than zero.

To disable this, comment out the rlimit-fsize=0 in avahi configuration, i.e.

[rlimits]
#rlimit-as=
rlimit-core=0
rlimit-data=4194304
#rlimit-fsize=0
  • Don't know why avahi-daemon is flaky in my centos6.9 container but yeah starting with "avahi-daemon --debug --no-rlimits" works around the problem. In my case "failed to start chroot() helper daemon." was a red herring, it reports that even when it successfully starts. – jamshid Jun 28 at 16:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.