Rollout Slot #3 paused: pam_lve 0.4-5 cron logging issue

Incident Report for CloudLinux

Identified

The `pam_lve 0.4-5` update, delivered via gradual rollout Slot #3, added audit logging of LVE entry/exemption decisions. Due to a defect in how these messages are emitted, the module alters the process-wide syslog facility of the calling service. The most visible effect is on cron: after a pam_lve message is logged, subsequent cron records may be tagged with the `auth` facility instead of `cron`, so they appear in `/var/log/messages` instead of `/var/log/cron` (in journald: `SYSLOG_FACILITY=4` instead of `9`). Tools that rely on the cron facility (logwatch, fail2ban, SIEM agents) may also be confused.

**LVE resource limits, CageFS, and system security are NOT affected — this is a log-routing issue only.** The new log lines themselves (e.g. `pam_lve: User root (UID 0) exempted from LVE: UID below min_uid threshold`) are intended audit logging; only their side effect on the syslog facility is a defect.

To check whether a server is affected: `rpm -q pam_lve` — version 0.4-5 is affected, 0.4-3 is not.

## Slot pause

We have paused rollout Slot #3. No new servers will receive these packages until a fixed build is published. Servers that already installed the update keep the current packages — there is no automatic downgrade. The root cause has been identified, and a fix is in progress.

## Affected packages (Slot #3 contents)

- `pam_lve-0.4-5` — CloudLinux 7, 8, 9, 10 (`pam-lve 0.4-5` on Ubuntu) — contains the issue
- `bsock-0.10-1` — CloudLinux 7–10, Ubuntu — no known issues; paused only because it shipped in the same slot. No action needed for bsock.

## ETA

A fixed pam_lve build is expected within **1–2 business days**. The rollout will then resume with the corrected package, and servers already on 0.4-5 will receive the fix through the resumed rollout.

## Mitigation for affected servers (optional)

If the logging behavior causes problems, either option below resolves it; otherwise, you can simply wait for the fixed package.

**Option A** — downgrade pam_lve to the stable version (0.4-3). Takes effect for new sessions immediately; no service restart or reboot required:

```
yum clean all && yum downgrade pam_lve
```

Ubuntu:

```
apt-get update && apt-get install --allow-downgrades pam-lve=0.4-3
```

**Option B** — keep 0.4-5 and route cron logs by program name instead of facility (rsyslog):

```
cat > /etc/rsyslog.d/00-cron.conf <
if ($programname == "CROND" or $programname == "crond" or $programname == "anacron" or $programname == "run-parts") then {
action(type="omfile" file="/var/log/cron")
stop
}
EOF
systemctl restart rsyslog
```

## Package manager errors after the pause

If yum/dnf reports errors for the rollout slot repository after the pause (e.g., `Failed to download metadata for repo 'cloudlinux-rollout-3'` or a 404 on `repomd.xml`), clear the cached metadata and retry:

```
yum clean all
```

(Ubuntu: `apt-get update`.) The error is transient and does not affect other repositories.

Posted Aug 17, 2026 - 18:44 UTC

This incident affects: CloudLinux OS Components (CloudLinux Kernel).