On 15.03.2010 13:37, Stefan K. wrote: > Package: rsyslog > Version: 4.4.2-1~bpo50+1 > Severity: normal > > If I use the module for kernel logging ($imklog) and tell rsyslog to > drop its privileges after startup ($PrivDropToxxxx), it fills its logs > very fast (without message reduction) and consumes 100% CPU. > > I was surprised to see it working that way on recent Ubuntu. They have > the option $KLogPath, but it seems to be unknown to Debian and > official rsyslog documentation. Maybe they patched their sources?
> > Allowing nobody to read /proc/kmsg (root.root r-------- by default) did not > help. > Creating a system user/group like Ubuntu did not help. > > Is their a trick that Ubuntu uses, I am not aware of? There is. Reading from /proc/kmsg requires root privileges. There is no way around that [1] What Ubuntu does, it create a socket in /var/run, where the rsyslog process can read with unpriviledgeg rights, and they have a separate dd process (with root priviledges) that shovels the data from /dev/kmsg to /var/run/kmsg. The $KLogPath directive tell the imklog module (rsyslog), to read from /var/run/kmsg instead of /proc/kmsg. That's all it does and it is also available in 4.4.2. Cheers, Michael [1] There were discussion using capabilities to work around that. I.e. rsyslog would keep the CAP_ADMIN privilege when dropping root privileges which would allow to read from /proc/kmsg. Unfortunately CAP_ADMIN is a big hammer which retains most of your root rights, so you wouldn't gain much. -- Why is it that all of the instruments seeking intelligent life in the universe are pointed away from Earth?
signature.asc
Description: OpenPGP digital signature
