[Bug 220331] New: syslog-ng cannot log news messages
https://bugzilla.novell.com/show_bug.cgi?id=220331 Summary: syslog-ng cannot log news messages Product: openSUSE 10.2 Version: Beta 2 Platform: Other OS/Version: Other Status: NEW Severity: Major Priority: P5 - None Component: AppArmor AssignedTo: dreynolds@novell.com ReportedBy: seife@novell.com QAContact: dreynolds@novell.com OtherBugsDependingO 215208 nThis: root@strolchi:/var/log# grep syslog.*news messages Nov 10 17:34:43 strolchi syslog-ng[2707]: Cannot open file /var/log/news/news.notice for writing (Permission denied) Nov 12 23:47:02 strolchi syslog-ng[2707]: Cannot open file /var/log/news/news.err for writing (Permission denied) Nov 13 08:07:17 strolchi syslog-ng[13635]: Cannot open file /var/log/news/news.notice for writing (No such file or directory) root@strolchi:/var/log# grep news audit/audit.log type=APPARMOR msg=audit(1163176483.060:15): REJECTING w access to /var/log/news/news.notice (syslog-ng(2707) profile /sbin/syslog-ng active /sbin/syslog-ng) type=APPARMOR msg=audit(1163176483.060:16): REJECTING attribute (uid,ctime,) change to /var/log/news/news.notice (syslog-ng(2707) profile /sbin/syslog-ng active /sbin/syslog-ng) type=APPARMOR msg=audit(1163176483.060:17): REJECTING attribute (gid,ctime,) change to /var/log/news/news.notice (syslog-ng(2707) profile /sbin/syslog-ng active /sbin/syslog-ng) type=APPARMOR msg=audit(1163176483.060:18): REJECTING attribute (mode,ctime,) change to /var/log/news/news.notice (syslog-ng(2707) profile /sbin/syslog-ng active /sbin/syslog-ng) type=APPARMOR msg=audit(1163371622.680:19): REJECTING w access to /var/log/news/news.err (syslog-ng(2707) profile /sbin/syslog-ng active /sbin/syslog-ng) type=APPARMOR msg=audit(1163371622.680:20): REJECTING attribute (uid,ctime,) change to /var/log/news/news.err (syslog-ng(2707) profile /sbin/syslog-ng active /sbin/syslog-ng) type=APPARMOR msg=audit(1163371622.680:21): REJECTING attribute (gid,ctime,) change to /var/log/news/news.err (syslog-ng(2707) profile /sbin/syslog-ng active /sbin/syslog-ng) type=APPARMOR msg=audit(1163371622.680:22): REJECTING attribute (mode,ctime,) change to /var/log/news/news.err (syslog-ng(2707) profile /sbin/syslog-ng active /sbin/syslog-ng) type=APPARMOR msg=audit(1163401637.356:31): REJECTING w access to /var/log/news/news.notice (syslog-ng(13635) profile /sbin/syslog-ng active /sbin/syslog-ng) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.
https://bugzilla.novell.com/show_bug.cgi?id=220331 dreynolds@novell.com changed: What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|dreynolds@novell.com |seth.arnold@novell.com -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.
https://bugzilla.novell.com/show_bug.cgi?id=220331 ------- Comment #1 from suse-beta@cboltz.de 2006-11-18 16:31 MST ------- sbin.syslog-ng profile: /var/log/* w, should be /var/log/** w, (sbin.syslogd profile has this already) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.
https://bugzilla.novell.com/show_bug.cgi?id=220331 seth.arnold@novell.com changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |FIXED ------- Comment #2 from seth.arnold@novell.com 2006-11-21 15:39 MST ------- Accepted into autobuild, tarball apparmor-profiles-2.0.1-260.tar.gz Thanks! -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.
https://bugzilla.novell.com/show_bug.cgi?id=220331 seife@novell.com changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |REOPENED Resolution|FIXED | ------- Comment #3 from seife@novell.com 2006-11-24 05:18 MST ------- something gets logged: root@strolchi:~# l /var/log/news/ total 8 drwxr-x--- 2 news news 1024 14. Nov 15:57 ./ drwxr-xr-x 9 root root 5120 23. Nov 22:29 ../ -rw-r----- 1 news news 0 21. Nov 15:31 news.crit -rw-r----- 1 news news 0 21. Nov 15:31 news.err -rw-r----- 1 news news 1387 24. Nov 13:14 news.notice but still: root@strolchi:~# grep news /var/log/audit/audit.log |tail type=APPARMOR msg=audit(1163176483.060:18): REJECTING attribute (mode,ctime,) change to /var/log/news/news.notice (syslog-ng(2707) profile /sbin/syslog-ng active /sbin/syslog-ng) type=APPARMOR msg=audit(1163371622.680:19): REJECTING w access to /var/log/news/news.err (syslog-ng(2707) profile /sbin/syslog-ng active /sbin/syslog-ng) type=APPARMOR msg=audit(1163371622.680:20): REJECTING attribute (uid,ctime,) change to /var/log/news/news.err (syslog-ng(2707) profile /sbin/syslog-ng active /sbin/syslog-ng) type=APPARMOR msg=audit(1163371622.680:21): REJECTING attribute (gid,ctime,) change to /var/log/news/news.err (syslog-ng(2707) profile /sbin/syslog-ng active /sbin/syslog-ng) type=APPARMOR msg=audit(1163371622.680:22): REJECTING attribute (mode,ctime,) change to /var/log/news/news.err (syslog-ng(2707) profile /sbin/syslog-ng active /sbin/syslog-ng) type=APPARMOR msg=audit(1163401637.356:31): REJECTING w access to /var/log/news/news.notice (syslog-ng(13635) profile /sbin/syslog-ng active /sbin/syslog-ng) type=APPARMOR msg=audit(1163707139.121:26): REJECTING w access to /var/log/news/news.notice (syslog-ng(2972) profile /sbin/syslog-ng active /sbin/syslog-ng) type=APPARMOR msg=audit(1163707139.121:27): REJECTING attribute (uid,ctime,) change to /var/log/news/news.notice (syslog-ng(2972) profile /sbin/syslog-ng active /sbin/syslog-ng) type=APPARMOR msg=audit(1163707139.125:28): REJECTING attribute (gid,ctime,) change to /var/log/news/news.notice (syslog-ng(2972) profile /sbin/syslog-ng active /sbin/syslog-ng) type=APPARMOR msg=audit(1163707139.125:29): REJECTING attribute (mode,ctime,) change to /var/log/news/news.notice (syslog-ng(2972) profile /sbin/syslog-ng active /sbin/syslog-ng) root@strolchi:~# l /var/log/audit/audit.log -rw-r----- 1 root root 44133 24. Nov 13:12 /var/log/audit/audit.log This is RC1, i updated from the previous version root@strolchi:~# rpm -q apparmor-profiles apparmor-profiles-2.0.1-11 root@strolchi:~# rpm -q --changelog apparmor-profiles|head -4 * Di Nov 21 2006 - srarnold@suse.de - Bug 220331 - syslog-ng cannot log news messages - /var/log/** to mirror the old syslog profile -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.
https://bugzilla.novell.com/show_bug.cgi?id=220331 ------- Comment #4 from seife@novell.com 2006-11-24 05:21 MST ------- oops. 1163707139 is 2006-11-17. sorry. But i still have recent rejects in syslog: root@strolchi:~# date +%s 1164370827 root@strolchi:~# tail /var/log/audit/audit.log type=APPARMOR msg=audit(1164212309.877:15): REJECTING access to capability 'fowner' (syslog-ng(2699) profile /sbin/syslog-ng active /sbin/syslog-ng) type=DAEMON_END msg=audit(1164317198.885:9736) auditd normal halt, sending auid=0 pid=20241 subj= res=success, auditd pid=2967 type=DAEMON_START msg=audit(1164317359.345:8536) auditd start, ver=1.2.6, format=raw, auid=4294967295 pid=3220 res=success, auditd pid=32 type=CONFIG_CHANGE msg=audit(1164317359.442:9): audit_enabled=0 old=0 by auid=4294967295 type=CONFIG_CHANGE msg=audit(1164317359.674:10): audit_backlog_limit=256 old=64 by auid=4294967295 type=APPARMOR msg=audit(1164317360.246:11): REJECTING access to capability 'fowner' (syslog-ng(3022) profile /sbin/syslog-ng active /sbin/syslog-ng) type=APPARMOR msg=audit(1164317380.804:12): REJECTING access to capability 'fowner' (syslog-ng(3022) profile /sbin/syslog-ng active /sbin/syslog-ng) type=APPARMOR msg=audit(1164317380.804:13): REJECTING access to capability 'fowner' (syslog-ng(3022) profile /sbin/syslog-ng active /sbin/syslog-ng) type=APPARMOR msg=audit(1164322787.214:14): REJECTING access to capability 'fowner' (syslog-ng(3022) profile /sbin/syslog-ng active /sbin/syslog-ng) type=APPARMOR msg=audit(1164370321.160:15): REJECTING access to capability 'fowner' (syslog-ng(3022) profile /sbin/syslog-ng active /sbin/syslog-ng) But i have no idea for what file this is. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.
https://bugzilla.novell.com/show_bug.cgi?id=220331 ------- Comment #5 from suse-beta@cboltz.de 2006-11-24 17:23 MST ------- I can reproduce this ;-) edit your syslog-ng.conf like this: destination newscrit { file("/var/log/news/news.crit" owner(news) group(news) perm(600)); }; then: # rm /var/log/news/news.crit # rcsyslog restart # echo test | logger -p news.crit # aa-logprof Another issue: please add /dev/log wl, to the syslog-ng profile! BTW: I just compared the syslogd and syslog-ng profiles (still on beta2 + above fix). The cleaned up diff (without pid file, config etc. and things mentioned above): --- syslogd 2006-11-25 00:53:29.000000000 +0100 +++ syslog-ng 2006-11-25 00:53:37.000000000 +0100 + capability chown, + capability fsetid, - capability dac_read_search, - capability sys_tty_config, - /dev/tty* w, + /dev/tty10 w, - /var/lib/*/dev/log wl, + /var/lib/*/dev/log w, - /var/log/** rw, + /var/log/** w, - /var/run/utmp rw, - /var/spool/compaq/nic/messages_fifo rw, I'm not familar enough with syslogd or syslog-ng to tell you which additions should be ported from the syslogd to the syslog-ng profile (and the other way round) - but the above diff should give you some hints ;-) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.
https://bugzilla.novell.com/show_bug.cgi?id=220331 seth.arnold@novell.com changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |RESOLVED Resolution| |FIXED ------- Comment #6 from seth.arnold@novell.com 2006-12-04 15:53 MST ------- Thanks for the feedback, fixed in autobuild with tarball 262, accepted into 10.2. Hurray. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.
participants (1)
-
bugzilla_noreply＠novell.com