Re: klog under linux 2.6.0-test11

On Sat, Dec 06, 2003 at 02:11:53AM -0500, George Georgalis wrote:
> I've not been able to get socklog-1.0.0 (socklog-klog)
> to work correctly on Athlon 2.6.0-test11 kernels:

> @400000003fd17d812b9e6b84 socklog: fatal: read(): permission denied
> 
> I modified my /etc/socklog/klog/run file as such:
> #!/bin/sh
> exec </proc/kmsg
> exec 2>&1
> exec softlimit -m 2000000 setuidgid log strace socklog ucspi

The script opens /proc/kmsg as root and redirects standard input to read
from that file-descriptor, drops permissions to user 'log', and then
execs socklog to read from standard input.  Even though 'log' doesn't
have permissions to read the file /proc/kmsg, it's allowed to read from
the open file-descriptor (stdin).  This should work under normal unixes.

> @400000003fd17dcc30717f34 read(0, 0x804b740, 8192)                = -1 EPERM (Operation not permitted)

> I don't know what it is but "read(0, 0x804b740, 8192)" seems the cause.
> 
> This is an older install and I'm not sure what gcc I used to build
> socklog, but the kernel was made with gcc 3.3.2 if that makes any
> difference. What's going on here?

Do you have any ``security-patches'' applied to the kernel source that
need to be configured properly?

Regards, Gerrit.