Monday, September 18, 2023

Do rsyslogd need to always start as root?

A number of typical rsyslog feature require root, but not all. If such capabilities are required usually rsyslog will complain inside its own logs.


Examples are:


imuxsock - local syslog logging (can't open /dev/log) - you could work around this with permissiosn - I didn't need it

imklog - kernel logging - obviously needs root

$FileOwner - ie chmod - obviously needs root

$ProveDropToUser/Group

Access to the console, broadcast messages - eg xconsole etc,...

Apart from that the networking modules work fine as long as they use non-priveleged ports. Additionally the logging/spooling directories must be accessible. Noteworthy is that rsyslog.conf seems to use absolute paths. 

references:

https://unix.stackexchange.com/questions/70491/start-rsyslog-as-unprivileged-user

No comments:

Post a Comment