kernel message after replacing rsyslog with syslog-ng

[Ivars Strazdiņš]

Binary package hint: syslog-ng

After replacing rsyslog with syslog-ng, the follwing message appears in dmesg log:

Attempt to access syslog with CAP_SYS_ADMIN but no CAP_SYSLOG (deprecated).

 Apr 13 11:30:33 jeos11 kernel: [ 6.007252] ------------[ cut here ]------------
Apr 13 11:30:33 jeos11 kernel: [ 6.007259] WARNING: at /build/buildd/linux-2.6.38/kernel/printk.c:288 do_syslog+0xc0/0x550()
Apr 13 11:30:33 jeos11 kernel: [ 6.007261] Hardware name: VMware Virtual Platform
Apr 13 11:30:33 jeos11 kernel: [ 6.007262] Attempt to access syslog with CAP_SYS_ADMIN but no CAP_SYSLOG (deprecated).
Apr 13 11:30:33 jeos11 kernel: [ 6.007263] Modules linked in: vesafb ppdev vmw_balloon psmouse bridge stp serio_raw floppy parport_pc lp parport vmw_
pvscsi vmxnet3 vmxnet
Apr 13 11:30:33 jeos11 kernel: [ 6.007273] Pid: 1157, comm: syslog-ng Tainted: G W 2.6.38-8-virtual #42-Ubuntu
Apr 13 11:30:33 jeos11 kernel: [ 6.007275] Call Trace:
Apr 13 11:30:33 jeos11 kernel: [ 6.007279] [<ffffffff8106576f>] ? warn_slowpath_common+0x7f/0xc0
Apr 13 11:30:33 jeos11 kernel: [ 6.007281] [<ffffffff81065866>] ? warn_slowpath_fmt+0x46/0x50
Apr 13 11:30:33 jeos11 kernel: [ 6.007285] [<ffffffff81278019>] ? security_capable+0x29/0x30
Apr 13 11:30:33 jeos11 kernel: [ 6.007288] [<ffffffff81066a70>] ? do_syslog+0xc0/0x550
Apr 13 11:30:33 jeos11 kernel: [ 6.007291] [<ffffffff811c54bb>] ? proc_lookup+0x1b/0x20
Apr 13 11:30:33 jeos11 kernel: [ 6.007295] [<ffffffff811befc7>] ? proc_root_lookup+0x27/0x50
Apr 13 11:30:33 jeos11 kernel: [ 6.007298] [<ffffffff8116e385>] ? d_alloc_and_lookup+0x45/0x90
Apr 13 11:30:33 jeos11 kernel: [ 6.007301] [<ffffffff811c9dbc>] ? kmsg_open+0x1c/0x20
Apr 13 11:30:33 jeos11 kernel: [ 6.007304] [<ffffffff811be53d>] ? proc_reg_open+0xad/0x1a0
Apr 13 11:30:33 jeos11 kernel: [ 6.007306] [<ffffffff811c9d80>] ? kmsg_release+0x0/0x20
Apr 13 11:30:33 jeos11 kernel: [ 6.007308] [<ffffffff811c9da0>] ? kmsg_open+0x0/0x20
Apr 13 11:30:33 jeos11 kernel: [ 6.007311] [<ffffffff811be490>] ? proc_reg_open+0x0/0x1a0
Apr 13 11:30:33 jeos11 kernel: [ 6.007314] [<ffffffff8116206e>] ? __dentry_open+0xce/0x2f0
Apr 13 11:30:33 jeos11 kernel: [ 6.007316] [<ffffffff8116e1b3>] ? generic_permission+0x23/0xc0
Apr 13 11:30:33 jeos11 kernel: [ 6.007319] [<ffffffff81163561>] ? nameidata_to_filp+0x71/0x80
Apr 13 11:30:33 jeos11 kernel: [ 6.007321] [<ffffffff81172628>] ? finish_open+0xc8/0x1b0
Apr 13 11:30:33 jeos11 kernel: [ 6.007324] [<ffffffff81171837>] ? do_path_lookup+0x87/0x160
Apr 13 11:30:33 jeos11 kernel: [ 6.007326] [<ffffffff81172de8>] ? do_filp_open+0x2c8/0x7c0
Apr 13 11:30:33 jeos11 kernel: [ 6.007329] [<ffffffff81179ca6>] ? d_kill+0xe6/0x140
Apr 13 11:30:33 jeos11 kernel: [ 6.007332] [<ffffffff8117ff77>] ? alloc_fd+0xf7/0x150
Apr 13 11:30:33 jeos11 kernel: [ 6.007334] [<ffffffff811635da>] ? do_sys_open+0x6a/0x150
Apr 13 11:30:33 jeos11 kernel: [ 6.007336] [<ffffffff811636e0>] ? sys_open+0x20/0x30
Apr 13 11:30:33 jeos11 kernel: [ 6.007339] [<ffffffff8100bfc2>] ? system_call_fastpath+0x16/0x1b
Apr 13 11:30:33 jeos11 kernel: [ 6.007341] ---[ end trace 7e1fd0a6f7777ab7 ]---

ProblemType: Bug
DistroRelease: Ubuntu 11.04
Package: syslog-ng 3.1.3-3
ProcVersionSignature: Ubuntu 2.6.38-8.42-virtual 2.6.38.2
Uname: Linux 2.6.38-8-virtual x86_64
Architecture: amd64
Date: Wed Apr 13 11:53:06 2011
ExecutablePath: /usr/sbin/syslog-ng
InstallationMedia: Ubuntu-Server 11.04 "Natty Narwhal" - Beta 1 amd64 (20110329.2)
ProcEnviron: PATH=(custom, no user)
SourcePackage: syslog-ng
UpgradeStatus: No upgrade log present (probably fresh install)

[tdn (spam-thomasdamgaard)]

I think this is the same bug I am experiencing. Trace: http://paste.adora.dk/P2029.html

[Gergely Nagy (algernon)]

The kernel developers decided that one should use CAP_SYSLOG to access /proc/kmsg, instead of CAP_SYS_ADMIN (a good change, in itself), and that the kernel should warn once per process when a program tries to access it with the old capability.

The easy solution or workaround for Natty is to disable capability usage in syslog-ng: remove the comment from the #SYSLOGNG_OPTS="--no-caps" line in /etc/defaults/syslog-ng.

Newer versions of syslog-ng (3.3 and up) have support for CAP_SYSLOG. Versions prior to that will trigger the kernel warning unless compiled without capability support, or without disabling them on the command-line.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Alessandro Menti (elgaton)]

Thanks for the detailed report.

There is another bug report (bug #760464) for this issue that has been already triaged. The progress on this bug can be followed there, so I'm marking this issue as a duplicate.

[penalvch (penalvch)]

Ivars Strazdiņš, this bug was reported a while ago and there hasn't been any activity in it recently. We were wondering if this is still an issue? If so, could you please test for this with the latest development release of Ubuntu? ISO images are available from http://cdimage.ubuntu.com/daily-live/current/ .

If it remains an issue, could you please run the following command in the development release from a Terminal (Applications->Accessories->Terminal), as it will automatically gather and attach updated debug information to this report:

apport-collect -p linux <replace-with-bug-number>

Also, could you please test the latest upstream kernel available (not the daily folder) following https://wiki.ubuntu.com/KernelMainlineBuilds ? It will allow additional upstream developers to examine the issue. Once you've tested the upstream kernel, please comment on which kernel version specifically you tested. If this bug is fixed in the mainline kernel, please add the following tags:
kernel-fixed-upstream
kernel-fixed-upstream-VERSION-NUMBER

where VERSION-NUMBER is the version number of the kernel you tested. For example:
kernel-fixed-upstream-v3.13-rc5

This can be done by clicking on the yellow circle with a black pencil icon next to the word Tags located at the bottom of the bug description. As well, please remove the tag:
needs-upstream-testing

If the mainline kernel does not fix this bug, please add the following tags:
kernel-bug-exists-upstream
kernel-bug-exists-upstream-VERSION-NUMBER

As well, please remove the tag:
needs-upstream-testing

Once testing of the upstream kernel is complete, please mark this bug's Status as Confirmed. Please let us know your results. Thank you for your understanding.

[Launchpad Janitor (janitor)]

[Expired for linux (Ubuntu) because there has been no activity for 60 days.]