rsyslog fails to read kmsg on 2.6.33 kernels

[Rocko]

Binary package hint: rsyslog

Kernel logging is disabled on all kernels other than the stock Ubuntu kernel, because rsyslog fails to read kmsg. Instead, it reports:

"kernel: imklog: Cannot read proc file system, 1."

This is intentional on older kernels (see bug #523610, comment 35), but it is also happening on the latest 2.6.33.2 kernel:

sudo python
>>> import os
>>> f=open('/proc/kmsg')
>>> os.seteuid(1000)
>>> f.read(0)
''
>>> f.read(1)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
IOError: [Errno 1] Operation not permitted

I don't believe it's in the spirit of things to disable logging on newer kernels (it cuts out a large number of testers for rc kernels, for instance). Why is it necessary for rsymlog to drop root privileges and disable logging if it can't access kmsg?

ProblemType: Bug
DistroRelease: Ubuntu 10.04
Package: rsyslog 4.2.0-2ubuntu8
Uname: Linux 2.6.33.2-generic x86_64
NonfreeKernelModules: nvidia
Architecture: amd64
CheckboxSubmission: 1bd8e90541d49b96c13cbfcc9baf103b
CheckboxSystem: d00f84de8a555815fa1c4660280da308
Date: Sat Apr 17 17:58:38 2010
InstallationMedia: Ubuntu 10.04 "Lucid Lynx" - Alpha amd64 (20100224.1)
ProcEnviron:
 PATH=(custom, user)
 LANG=en_AU.utf8
 SHELL=/bin/bash
SourcePackage: rsyslog

[Rocko (rockorequin)]

Part of the problem seems to be that the patch to allow read access to kmsg to non-root users (see bug #515623, comment 1) isn't applied to 2.6.33.2. I applied the patch (it almost worked out-of-the-box, but I needed to define SYSLOG_CONTEXT_SYSCALL in printk.c) and this resolves the problem.

The patch appears to be included in 2.6.34-rc4, but I can't test this yet as it kernel panics on my PC at some point after X starts.

I still think rsyslog should default to the Debian behaviour (ie root access to kmsg) if 'de-rooting' doesn't work, but perhaps the quickest 'fix' for this is to include a release note saying that kernel logging is not supported with 2.6.33 kernels (or in fact any custom kernels prior to 2.6.34).

[Clint Byrum (clint-fewbar)]

As Rocko suggests, this bug is fixed in the 2.6.34 kernel, which is currently in maverick:

clint@ubuntu:~$ uname -a
Linux ubuntu 2.6.34-4-generic #11-Ubuntu SMP Tue May 25 18:53:52 UTC 2010 x86_64 GNU/Linux
clint@ubuntu:~$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu maverick (development branch)
Release: 10.10
Codename: maverick
clint@ubuntu:~$ sudo python
Python 2.6.5 (r265:79063, Apr 16 2010, 13:57:41)
[GCC 4.4.3] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import os
>>> f=open('/proc/kmsg')
>>> os.seteuid(1000)
>>> f.read(0)
''
>>> f.read(1)
^CTraceback (most recent call last):
  File "<stdin>", line 1, in <module>
KeyboardInterrupt

The KeyboardInterrupt was after 30 seconds waiting for the kernel to print something.

[Volodymyr Kolesnykov (sjinks)]

Does not happen in 2.6.32-22

uname -a:

Linux hvosting.sjinks.pro 2.6.32-22-server #35-Ubuntu SMP Tue Jun 1 15:34:46 UTC 2010 x86_64 GNU/Linux

$ sudo python
Python 2.6.5 (r265:79063, Apr 16 2010, 13:57:41)
[GCC 4.4.3] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import os;
>>> f=open('/proc/kmsg')
>>> os.seteuid(1000)
>>> f.read(0)
''
>>> f.read(1)
^CTraceback (most recent call last):
  File "<stdin>", line 1, in <module>
KeyboardInterrupt

[Rocko (rockorequin)]

No, it has never been a problem in the Ubuntu 2.6.32 kernel because the kernel devs add the required patch for you! It is only a problem with the upstream 2.6.33 kernel.

[Volodymyr Kolesnykov (sjinks)]

Mmm, I had a problem with this on linux-image-2.6.31-21-server (2.6.31-21.59): "imklog: Cannot read proc file system, 1." in /var/log/kern.log.

Update to linux-image-2.6.32-22-server (2.6.32-22.35) resolved it.

[Volodymyr Kolesnykov (sjinks)]

Oh sorry, I have mis-read your message :-(

[gene (eugenios)]

Happens to my custom kernel too.
uname -a
Linux 2.6.32-rc5-custom #1 SMP Sun Nov 8 01:19:08 EST 2009 i686 GNU/Linux

[Matt Zimmerman (mdz)]

According to the comments, this bug affects neither current Ubuntu kernels nor current upstream kernels, so marking fixed.

[Nicolargo (nicolashennion)]

"Jan 14 15:31:51 localhost kernel: imklog: Cannot read proc file system, 1."

Distribution: Ubuntu Server 10.04 LTS
Kernel: 2.6.32 (XenU)
Rsyslog: 4.2.0-2ubuntu8.1