Re: Syslog-NG Fails as of Kernel 2.6.38-rc1

From: Gergely Nagy
Date: Fri Jan 28 2011 - 05:46:10 EST

> > The following appears in dmesg from kernels 2.6.38-rc1 to
> > 2.6.38-rc2-git5 (Not an issue in 2.6.37 stable):


> > ----------
> > ::Starting Syslg-NG [BUSY] Error opening file for reading:
> > filename '/proc/kmsg', error='Operation not permitted (1)'
> > Error initializing source driver: source='src', id='src#2' Error
> > initializing message pipline;
> > [FAIL]

The problem is, that syslog-ng doesn't have the CAP_SYSLOG capability,
only CAP_SYS_ADMIN, which was enough pre-2.6.38. In 2.6.38+ however, one
needs CAP_SYSLOG (it was split out from CAP_SYS_ADMIN).

Which pretty much means that any userspace code that was using
CAP_SYS_ADMIN to access /proc/kmsg will have to be updated to use
CAP_SYSLOG (either instead, or in addition to CAP_SYS_ADMIN) in order to
work on new kernels.

I find that quite unfortunate, to be honest, as older applications that
aren't upgraded along with the kernel will simply break.


To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at
Please read the FAQ at