Plesk services or webmail do not operate properly when Grsecurity is enabled on a server

Symptoms

• One of the following symptoms is true for webmail:

  • Unable to log into Roundcube webmail with correct credentials:

    CONFIG_TEXT: Connection to storage server failed

  • Webmail is not accessible with the error message:

    PLESK_INFO: Internal Server Error
    The server encountered an internal error or misconfiguration and was unable to complete your request.
    Please contact the server administrator at root@localhost to inform them of the time this error occurred, and the actions you performed just before this error.
    More information about this error may be available in the server error log.

• Children of different processes are killed with signal 9. The corresponding message appears in /var/log/maillog:

  CONFIG_TEXT: server spamd[17857]: spamd: handled cleanup of child pid [12336] due to SIGCHLD: KILLED, signal 9 (0009)
  
  server dovecot: service=pop3, user=john.doe@example.com ip=[203.0.113.2]. Fatal: master: service(pop3): child 32379 killed with signal 9

• Plesk or Plesk extensions do not work.

• The following error messages appear in /var/log/messages, /var/log/syslog or /var/lib/rsyslog:

  CONFIG_TEXT: kernel: PAX: terminating task: /opt/plesk/php/7.3/bin/php-cgi(php-cgi):20401, uid/euid: 994/994, PC: 000003337a7ed010, SP: 0000039fadcfccd8
  ...
  kernel: grsec: denied resource overstep by requesting 4096 for RLIMIT_CORE against limit 0 for /opt/plesk/php/7.3/bin/php-cgi[php-cgi:20401] uid/euid:994/994 gid/egid:1006/1006, parent /usr/sbin/httpd[/usr/sbin/httpd:27947] uid/euid:0/48 gid/egid:48/48

  ---

  CONFIG_TEXT: Application: plesk-migrator
  Error: denied RWX mmap of <;anonymous mapping>; by /usr/local/psa/admin/sbin/modules/panel-migrator/plesk-migrator[plesk-migrator:25177] uid/euid:0/0 gid/egid:0/1001, parent /usr/bin/sw-engine[sw-engine:25164] uid/euid:0/0 gid/egid:0/0

Cause

Grsecurity system is blocking Plesk executable files.

Resolution

Grsecurity is not supported by Plesk.

As a workaround, add the binary from the error message to exclusions of PAX monitoring. In this example, PHP 7.3 is added to the exclusions:

# paxctl -cm /opt/plesk/php/7.3/bin/php-cgi