HTML disarming died, status = 13

[Ferry van Aesch]

Hi Shawn,

Ignore Denial Of Service = no

I don’t have SELinux or Apparmor installed, I believe (believe!) I have all permissions set correctly, and most emails come in just fine, with or without HTML in them. Now, the kernel level issue is what I might have to look into. It’s a very low usage VPS though, it’s pretty much idling over 99% of the time. I don’t see anything in dmesg indicating limits. I’ll do a bit of digging in that area.

Thanks!
Ferry


From: MailScanner <mailscanner-bounces+ferry=vanaesch.com at lists.mailscanner.info> on behalf of Shawn Iverson via MailScanner <mailscanner at lists.mailscanner.info>
Reply to: MailScanner Discussion <mailscanner at lists.mailscanner.info>
Date: Monday 29 June 2020 at 13:42
To: "mailscanner at lists.mailscanner.info" <mailscanner at lists.mailscanner.info>
Cc: Shawn Iverson <shawniverson at summitgrid.com>
Subject: Re: HTML disarming died, status = 13


Ferry,

I am having trouble reproducing the issue on my end. I am still looking into this. This is looking more like a failure to spawn the child process and pipe the results back to the parent process.

Error 13 on a pipe is "Permission Denied." This can be caused for a variety of reasons. Filesystem permissions, mandatory access control issues (i.e. SELinux or Apparmor), and kernel level issues such as hitting an upper limit that is set too low or a kernel bug.

What do you currently have for this setting in MailScanner?

"Ignore Denial Of Service"
On 6/29/20 3:47 AM, Ferry van Aesch via MailScanner wrote:
I’m still trying to get my head around this. These failures genuinely seem to be random. Amazon notifications for instance, very standard layout, most come in perfectly fine and recently one of them failed. I run it through the queue again and it passes without failure. I’m a bit lost tbh.


From: Ferry van Aesch <ferry at vanaesch.com><mailto:ferry at vanaesch.com>
Date: Tuesday 16 June 2020 at 19:24
To: MailScanner Discussion <mailscanner at lists.mailscanner.info><mailto:mailscanner at lists.mailscanner.info>
Subject: Re: HTML disarming died, status = 13

Hi Shawn,

Thanks for getting back to me so quickly. Please see the sanitised email attached. (I assume attaching works with the mailing list?)
It’s not happening with every message indeed; but it’s a reasonable amount of the emails it processes. I just ran the original message (cat message|sendmail -t) and it was delivered without a problem.

Thanks!
Ferry


From: MailScanner <mailscanner-bounces+ferry=vanaesch.com at lists.mailscanner.info><mailto:mailscanner-bounces+ferry=vanaesch.com at lists.mailscanner.info> on behalf of Shawn Iverson via MailScanner <mailscanner at lists.mailscanner.info><mailto:mailscanner at lists.mailscanner.info>
Reply to: MailScanner Discussion <mailscanner at lists.mailscanner.info><mailto:mailscanner at lists.mailscanner.info>
Date: Tuesday 16 June 2020 at 18:39
To: MailScanner has detected a possible fraud attempt from "lists.mailscanner.info" claiming to be MailScanner has detected a possible fraud attempt from "lists.mailscanner.info" claiming to be "mailscanner at lists.mailscanner.info"<mailto:mailscanner at lists.mailscanner.info> <mailscanner at lists.mailscanner.info><mailto:mailscanner at lists.mailscanner.info>
Cc: Shawn Iverson <shawniverson at summitgrid.com><mailto:shawniverson at summitgrid.com>
Subject: Re: HTML disarming died, status = 13


This message is by design, as long as you are not caught in a loop and it is not happening with every message.  There's something in the HTML that killed the child spawned to perform the disarming.  Depending on the scenario, a sample of the email (sanitized) might be helpful to isolate what is going on here and improve the HTML Disarming code.

Shawn




--
[Image removed by sender.]
Shawn Iverson
shawniverson at summitgrid.com<mailto:shawniverson at summitgrid.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20200629/dc0c4fe5/attachment.html>