Messages in this thread | | | Subject | Re: CAP_SYSLOG, 2.6.38 and user space | From | Gergely Nagy <> | Date | Fri, 04 Feb 2011 09:40:04 +0100 |
| |
On Fri, 2011-02-04 at 09:03 +0100, Marc Koschewski wrote: > Moreover, this change really is 'hell' on _many_ machines. We had discussed a > thousands time to not break existing applications. So a) either make it optional in > the kernel so that userspace still works with CAP_SYS_ADMIN _and_ CAP_SYSLOG > while dropping a note that it should be fixed in userspace _and_ mark it as > deprecated as of mid 2012 or b) revert it.
I think the sysctl method would be superior, because it places the migration time in the hands of the distributions/admins, and gives syslogds a way to adjust, and use either CAP_SYS_ADMIN or CAP_SYSLOG, based on the presence of the sysctl setting (as opposed to using either and just postponing the flag-day from 2.6.38 to mid 2012, where we'd have the same issues we have now: unupgraded userspace breaking).
Having both CAP_SYS_ADMIN and CAP_SYSLOG at the same time, for the sole purpose of reading kernel log messages would kind of defeat the purpose of CAP_SYSLOG. Therefore, a solution that allows both at the same time doesn't look all that good to me.
However, having it toggle-able does, and solves all my worries at least: defaulting to CAP_SYS_ADMIN maintains backwards compatibility, upgraded systems can switch to CAP_SYSLOG if and when the system is ready for that. All's well!
-- |8]
| |