klog under linux 2.6.0-test11

I've not been able to get socklog-1.0.0 (socklog-klog)
to work correctly on Athlon 2.6.0-test11 kernels:

@400000003fd17d7c2223ccac socklog: fatal: read(): permission denied
@400000003fd17d7d24122374 socklog: fatal: read(): permission denied
@400000003fd17d7e25ec59e4 socklog: fatal: read(): permission denied
@400000003fd17d7f27d05454 socklog: fatal: read(): permission denied
@400000003fd17d8029a8833c socklog: fatal: read(): permission denied
@400000003fd17d812b9e6b84 socklog: fatal: read(): permission denied

I modified my /etc/socklog/klog/run file as such:

#!/bin/sh
exec </proc/kmsg
exec 2>&1
exec softlimit -m 2000000 setuidgid log strace socklog ucspi


and found:

@400000003fd17dcc30534cbc open("/lib/libc.so.6", O_RDONLY)        = 3
@400000003fd17dcc3054db2c read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\30\222"..., 1024) = 1024
@400000003fd17dcc3058368c fstat64(3, {st_mode=S_IFREG|0755, st_size=1153784, ...}) = 0
@400000003fd17dcc305a519c old_mmap(NULL, 1166560, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0x4001e000
@400000003fd17dcc305ba18c mprotect(0x40131000, 40160, PROT_NONE)  = 0
@400000003fd17dcc305d011c old_mmap(0x40131000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 0x113000) = 0x40131000
@400000003fd17dcc305f992c old_mmap(0x40137000, 15584, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x40137000
@400000003fd17dcc3060ed04 close(3)                                = 0
@400000003fd17dcc306e4ae4 munmap(0x40014000, 37165)               = 0
@400000003fd17dcc30717f34 read(0, 0x804b740, 8192)                = -1 EPERM (Operation not permitted)
@400000003fd17dcc307382d4 write(2, "socklog: fatal: read(): permissi"..., 42socklog: fatal: read(): permission denied
@400000003fd17dcc30743e54 ) = 42
@400000003fd17dcc3076caac _exit(111)                              = ?
@400000003fd17dcd320fe90c execve("/command/socklog", ["socklog", "ucspi"], [/* 3 vars */]) = 0
@400000003fd17dcd3492cb2c uname({sys="Linux", node="trot.local", ...}) = 0
@400000003fd17dcd349714d4 brk(0)                                  = 0x8050000
@400000003fd17dcd34994b3c open("/etc/ld.so.preload", O_RDONLY)    = -1 ENOENT (No such file or directory)
@400000003fd17dcd349b470c open("/etc/ld.so.cache", O_RDONLY)      = 3
@400000003fd17dcd349c8b44 fstat64(3, {st_mode=S_IFREG|0644, st_size=37165, ...}) = 0
@400000003fd17dcd349ef85c old_mmap(NULL, 37165, PROT_READ, MAP_PRIVATE, 3, 0) = 0x40014000
@400000003fd17dcd34a082e4 close(3)                                = 0


I don't know what it is but "read(0, 0x804b740, 8192)" seems the cause.

This is an older install and I'm not sure what gcc I used to build
socklog, but the kernel was made with gcc 3.3.2 if that makes any
difference. What's going on here?



I got an offline response from the [email protected] list that said
removing "setuidgid log" from my run script would make the error go
away, is that the _only_ fix?

-r--------    1 root     root            0 Dec  6 17:52 /proc/kmsg

I tried changing the ownership:

-r--------    1 log      root            0 Dec  6 17:53 /proc/kmsg

Even opening it up completely:

-r--r--r--    1 log      root            0 Dec  6 17:57 /proc/kmsg

...same problem. Guess I could run socklog as root, but that doesn't
sound right either.

// George

-- 
GEORGE GEORGALIS, System Admin/Architect    cell: 646-331-2027    <IXOYE><
Security Services, Web, Mail,            mailto:[email protected] 
Multimedia, DB, DNS and Metrics.       http://www.galis.org/george