Re: klog under linux 2.6.0-test11

On Sat, Dec 06, 2003 at 06:01:56PM -0500, George Georgalis wrote:
> I've not been able to get socklog-1.0.0 (socklog-klog)
> to work correctly on Athlon 2.6.0-test11 kernels:

> @400000003fd17d812b9e6b84 socklog: fatal: read(): permission denied

[...]
> @400000003fd17dcc30717f34 read(0, 0x804b740, 8192)                = -1 EPERM (Operation not permitted)
> @400000003fd17dcc307382d4 write(2, "socklog: fatal: read(): permissi"..., 42socklog: fatal: read(): permission denied
> @400000003fd17dcc30743e54 ) = 42
> @400000003fd17dcc3076caac _exit(111)                              = ?

> This is an older install and I'm not sure what gcc I used to build
> socklog, but the kernel was made with gcc 3.3.2 if that makes any
> difference. What's going on here?

It's the proc filesystem implementation in linux 2.6.x.

> I got an offline response from the [email protected] list that said
> removing "setuidgid log" from my run script would make the error go
> away, is that the _only_ fix?

Yes, running the socklog program as root to process kernel message under
linux 2.6.x kernels is the only workaround I'm currently aware of.

The socklog-klog run script first opens a file descriptor as root, then
drops permissions to an unprivileged user, and starts reading kernel
messages from the filedescriptor.  This technique works fine with normal
filesystems.

Unfortunately the implementation of the proc filesystem in the 2.6.x
linux kernels makes open() a noop, and checks permissions in read().  So
the newer linux kernels force the application reading from /proc/kmsg to
run under root privileges.

See linux-2.6.1/fs/proc/kmsg.c and linux-2.6.1/kernel/printk.c, function
do_syslog().

Regards, Gerrit.