Coraza: another nginx-reload trigger in the same dpkg run can reload before the recheck #48

New issue

Open

opened 2026-10-01 14:38:38 -03:00 by marcos-mendez · 0 comments

marcos-mendez commented

2026-10-01 14:38:38 -03:00

(Migrated from github.com)

Remaining gap of the Coraza upgrade guard (Keel-Linux/common#21, packages/README.md "The Web overlays").

keel-overlay-coraza's dpkg trigger runs state recheck after coreruleset, libnginx-mod-http-coraza or libcoraza are upgraded, and turns Coraza off when the new files kill Nginx's workers (corazawaf/coraza-nginx#139). But another package in the same dpkg run can activate nginx's own nginx-reload trigger (any libnginx-mod-* does), and dpkg may process it before ours: Nginx reloads with the new rules, every worker dies, and requests hang until the recheck rolls back seconds later.

If dpkg is killed in that window (power loss, OOM, an interrupted apt), the recheck never runs and Nginx stays without workers, with Coraza still linked, until someone runs /usr/lib/keel/overlays/coraza/state recheck or disabled. Monit's nginx check restarts Nginx, which loads the same rules and dies again; waf-blocks alerts.

Options to weigh: a boot-time or Monit-driven state recheck (e.g. as the nginx check's restart program while Coraza is enabled), or making the recheck run before any reload by awaiting the trigger (interest instead of interest-noawait, which does not order it against nginx's trigger either).

Remaining gap of the Coraza upgrade guard (Keel-Linux/common#21, packages/README.md "The Web overlays"). keel-overlay-coraza's dpkg trigger runs `state recheck` after coreruleset, libnginx-mod-http-coraza or libcoraza are upgraded, and turns Coraza off when the new files kill Nginx's workers (corazawaf/coraza-nginx#139). But another package in the same dpkg run can activate nginx's own `nginx-reload` trigger (any libnginx-mod-* does), and dpkg may process it before ours: Nginx reloads with the new rules, every worker dies, and requests hang until the recheck rolls back seconds later. If dpkg is killed in that window (power loss, OOM, an interrupted apt), the recheck never runs and Nginx stays without workers, with Coraza still linked, until someone runs `/usr/lib/keel/overlays/coraza/state recheck` or `disabled`. Monit's nginx check restarts Nginx, which loads the same rules and dies again; waf-blocks alerts. Options to weigh: a boot-time or Monit-driven `state recheck` (e.g. as the nginx check's restart program while Coraza is enabled), or making the recheck run before any reload by awaiting the trigger (`interest` instead of `interest-noawait`, which does not order it against nginx's trigger either).