Bug 1062163 - btmp, wtmp deleted by update, possibly systemd
Summary: btmp, wtmp deleted by update, possibly systemd
Status: NEW
Alias: None
Product: openSUSE Tumbleweed
Classification: openSUSE
Component: Basesystem (show other bugs)
Version: Current
Hardware: Other Other
: P5 - None : Normal (vote)
Target Milestone: ---
Assignee: Marcus Meissner
QA Contact: E-mail List
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: 1065233
  Show dependency treegraph
 
Reported: 2017-10-07 02:23 UTC by Ralf Friedl
Modified: 2017-10-26 10:27 UTC (History)
4 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Ralf Friedl 2017-10-07 02:23:16 UTC
On two different machines, my /var/log/[bw]tmp was replaced with an empty file on 2017-10-01. The times from "rpm -qa --last" seem to indicate that it was the time when systemd-234-5.1.x86_64 was installed, although [bw]tmp are not owned by any package and I didn't find anything in the systemd scripts that seems to delete [bw]tmp.
On another machine, wtmp was completely deleted and I had to recreate it manually. The btmp there does not contain entries before 2017-10-06 17:57, but I can not determine whether there are entries missing before that time, although since then it is at least one entry per hour.

On all these machines I found multiple entries in /var/log/zypp/history
> # setting /var/log/btmp to root:root 0600. (wrong owner/group root:utmp)
The first such entry is from 2017-06-21. These seem to come from an unmodified /etc/permissions, so there must be something that changes the group to utmp so that it is then reset by chkstat. I don't know whether this is related to the deletion of the files.
Comment 1 Thorsten Kukuk 2017-10-10 11:17:22 UTC
/etc/permissions and /usr/lib/tmpfiles.d/var.conf have conflicting default permissions for /var/log/btmp.