Hello,
I'm trying to package syslog-ng 3.2-git, and ran into some troubles.
V3.2 has an interesting new feature, called SCL (system configuration
library), which tries to ease syslog-ng configuration. This works nicely
when apparmor is disabled.
SCL uses a script to generate part of the configuration. So, when
system(); is used in syslog-ng.conf, it actually calls a script, which
generates the missing parts based on the OS. In case of Linux, it's:
linux-6y8u:~ #
/usr/share/syslog-ng/include/scl/system/generate-system-source.sh
unix-dgram("/dev/log");
file("/proc/kmsg" program-override("kernel") flags(kernel));
When apparmor is enabled, this script is not run, instead I see
"permission denied" in the strace output.
Question: how should I modify /etc/apparmor.d/sbin.syslog-ng to be able
to run external scripts and/or applications. This is not only a problem
for SCL, but syslog-ng can use these both as log source and destination.
Once a solution is know, I'd put some comments in sbin.syslog-ng, so
users could extend the AppArmor ruleset easily instead of disabling it...
Bye,
--
Peter Czanik (CzP)