journal: enforce strict consistency for realtime timestamps on write
authormsizanoen1 <msizanoen@qtmlabs.xyz>
Sat, 8 Oct 2022 07:37:02 +0000 (14:37 +0700)
committermsizanoen1 <msizanoen@qtmlabs.xyz>
Mon, 9 Jan 2023 15:57:30 +0000 (22:57 +0700)
commit1d8d483f59ffa62974772fb58a8ef4abe88550ec
treebea75b39fcef44dcc2d2dec8472277763650529d
parent790096852738b4961ffd8b10664a67b3f075d612
journal: enforce strict consistency for realtime timestamps on write

Ensure all realtime timestamps in a journal file are strictly
ordered on write as a defense-in-depth measure. All known callers of
journal_file_append_entry and journal_file_copy_entry, which call this
function, should be able to handle the error by rotating the journal.

This is especially helpful for systems with RTC local time enabled,
where all log entries from initramfs might be recorded as several hours
later than it actually is, which won't get caught by journald during log
flushing. In those cases, the resulting inconsistency can cause libsystemd
to loop infinitely through journal files as observed in
`abrt-dump-journal-oops`.
src/journal/journald-server.c
src/libsystemd/sd-journal/journal-file.c