Allan McRae wrote:

Gerardo Exequiel Pozzi wrote:

...

Pierre Schmitz wrote:

...

Does anybody know what this message in dmesg is about? Was syslog-ng compiled for i686?

warning: `syslog-ng' uses 32-bit capabilities (legacy support in use)

Very out-of-date libcap, not only syslog-ng, also proftpd, vsftpd, pulseaudio, ntpd, virtualbox, etc, etc...

http://www.archlinux.org/packages/extra/i686/libcap/ (for linux 2.4)

Need to have libcap2 package for kernel 2.6 in Arch Linux http://www.kernel.org/pub/linux/libs/security/linux-privs/

I was confused about this as libcap is in [extra] so how can it make problems with a package in [core]?

So going from this comment in the bug report about libcap (http://bugs.archlinux.org/task/11917#comment41046) I get...

...

readelf -s /usr/sbin/syslog-ng | grep cap 33: 00000000 0 FUNC GLOBAL DEFAULT UND capset@GLIBC_2.1 (4) 177: 00000000 0 FUNC GLOBAL DEFAULT UND capget@GLIBC_2.1 (4) 473: 08228bd8 4 OBJECT GLOBAL DEFAULT 26 OPENSSL_ia32cap_P

Looks like libcap is a soft dep there. How?

Then rebuild in clean chroot:

...

readelf -s syslog-ng | grep cap 467: 08221b18 4 OBJECT GLOBAL DEFAULT 26 OPENSSL_ia32cap_P

And then the dmesg warning goes away... So, the lesson to learn is to _always build in a clean chroot_!

Allan

Agree about clean chroot. But maybe this is useful, and more secure syslog-ng setup, because it drop some capabilities that don't use it ;) You can see the syslog-ng process running without capabilities enabled (from /proc/PID/status): CapPrm: fffffffffffffeff CapEff: fffffffffffffeff Capabilities for `27939': =ep cap_setpcap-ep ## getpcaps program from latest libcap Shows that have all capabilities, of course, i can't drop it. But running the syslog-ng, with capabilities enabled (accidentally enabled now) you can see, many capabilities are droped :) CapPrm: 0000000000202c06 CapEff: 0000000000200002 Capabilities for `23652': = cap_dac_override,cap_sys_admin+ep cap_dac_read_search,cap_net_bind_service,cap_net_broadcast,cap_net_raw+p More secure syslog-ng ;) OK, this isn't default behavior in Arch Linux, but... -- Gerardo Exequiel Pozzi ( djgera ) http://www.djgera.com.ar KeyID: 0x1B8C330D Key fingerprint = 0CAA D5D4 CD85 4434 A219 76ED 39AB 221B 1B8C 330D