Arch Linux

Please read this before reporting a bug:

Do NOT report bugs when a package is just outdated, or it is in Unsupported. Use the 'flag out of date' link on the package page, or the Mailing List.

REPEAT: Do NOT report bugs for outdated packages!

FS#22555 - Upcoming syslog breakage with kernel 2.6.38

Attached to Project: Arch Linux
Opened by Xavier (shining) - Saturday, 22 January 2011, 19:20 GMT
Last edited by Tobias Powalowski (tpowa) - Thursday, 31 March 2011, 07:11 GMT
Task Type Bug Report
Category Packages: Core
Status Closed
Assigned To Tobias Powalowski (tpowa)
Eric Belanger (Snowman)
Thomas Bächler (brain0)
Architecture All
Severity Low
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 1
Private No


The following patch introduces a new CAP_SYSLOG capability required for syslog :;a=commit;h=ce6ada35bdf710d16582cc4869c26722547e6f11

So if this change remains in 2.6.38, libcap needs to be updated to 2.20 to be aware of the new cap :

And syslog-ng (and any other loggers?) needs to be patched to enable CAP_SYSLOG.

I have a working patch for syslog-ng based on the two I found in the above bug report.
This task depends upon

Closed by  Tobias Powalowski (tpowa)
Thursday, 31 March 2011, 07:11 GMT
Reason for closing:  Fixed
Comment by Tomas M. (eldragon) - Saturday, 22 January 2011, 22:03 GMT
hi, could you post your patch here?

im actually testing 2.6.38-rc2 and this patch could come in handy ;)

Comment by Xavier (shining) - Saturday, 22 January 2011, 22:10 GMT
There you go.

I asked one syslog-ng dev to provide an updated patch, but he would like to find a solution which works both with old and new libcap.
My patch requires the new libcap.
Comment by Xavier (shining) - Saturday, 22 January 2011, 22:40 GMT
I forgot we have kernel26-lts, so we definitely want to keep support for older kernels.
I don't know if always trying to enable both caps (syslog and sys_admin) could work. Otherwise, we probably need kernel version checking from pld patch.
Comment by Allan McRae (Allan) - Sunday, 23 January 2011, 06:35 GMT
Updated libcap is in [testing]. I leave the syslog-ng fix to someone else.
Comment by Xavier (shining) - Sunday, 23 January 2011, 13:05 GMT
Well maybe our best bet is to just apply pld patch, which checks the kernel version and acts accordingly.

Attached a trivial port of the patch to 3.2.2 - the concerned code did not change, just the file paths did, so I had to apply the patch manually.

Tested on 2.6.36 ARCH and 2.6.38-rc2.
Arch lts kernel does not boot on that system, but anyway for versions < 2.6.34, the patch does not change anything.
Comment by andrew swartz (andrewthomas) - Tuesday, 25 January 2011, 22:26 GMT
I used the above cap_syslog.patch to make a PKGBUILD in AUR

I tested it on kernel26, kernel26-lts and 2.6.38-rc2.
Comment by Thomas Bächler (brain0) - Tuesday, 25 January 2011, 22:48 GMT
Great. Sounds like a good solution. We can expect an upstream fix to be available with the next release anyway.
Comment by Xavier (shining) - Saturday, 05 February 2011, 22:37 GMT
Maybe we won't need any patch after all, .38 kernel will hopefully keep working with old userspace (current syslog-ng release).
Apparently it's still under discussion and nothing has been merged yet.
Comment by Greg (dolby) - Saturday, 26 March 2011, 09:55 GMT
Isnt this fixed in syslog-ng 3.2.2-2 in [testing] ?

The upstream bug report is still open..
Comment by Tobias Powalowski (tpowa) - Saturday, 26 March 2011, 09:57 GMT
Yes fixed in testing.
Comment by Greg (dolby) - Saturday, 26 March 2011, 10:28 GMT Comment by Tobias Powalowski (tpowa) - Saturday, 26 March 2011, 16:09 GMT
Well, i patched syslog now, I think thats enough for now.