Cannot start syslog-ng when apparmor is running

Question

I am unable to start syslog-ng when apparmor is running because it complains it is unable to find the system plugin:

service apparmor start 
 * Starting AppArmor ...
 *   Loading AppArmor profiles ...

service syslog-ng restart

WARNING: you are stopping a boot service * Stopping syslog-ng ... [ ok ] * Checking your configfile (/etc/syslog-ng/syslog-ng.conf) ... Error parsing source, source plugin system not found in /etc/syslog-ng/syslog-ng.conf at line 24, column 14:

source src { system(); internal(); }; ^^^^^^

syslog-ng documentation: http://www.balabit.com/support/documentation/?product=syslog-ng mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng * Configuration error. Please fix your configfile (/etc/syslog-ng/syslog-ng.conf)
[ !! ] * ERROR: syslog-ng failed to start

Now, once I stop apparmor: service apparmor stop

 * Stopping AppArmor ...
 *   Unloading AppArmor profiles    


service syslog-ng restart
 * Checking your configfile (/etc/syslog-ng/syslog-ng.conf) ...                                                                                                                                          [ ok ]
 * Starting syslog-ng ...

This is my syslog-ng apparmor rule:

# ------------------------------------------------------------------
#
#    Copyright (C) 2006-2009 Novell/SUSE
#    Copyright (C) 2006 Christian Boltz
#    Copyright (C) 2010 Canonical Ltd.
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------

#include <tunables/global>

#define this to be where syslog-ng is chrooted
@{CHROOT_BASE}=""

profile syslog-ng /{usr/,}sbin/syslog-ng {
  #include <abstractions/base>
  #include <abstractions/consoles>
  #include <abstractions/nameservice>
  #include <abstractions/mysql>
  #include <abstractions/openssl>

  capability chown,
  capability dac_override,
  capability dac_read_search,
  capability fsetid,
  capability fowner,
  capability sys_tty_config,
  capability sys_resource,
  capability syslog,

  unix (receive) type=dgram,
  unix (receive) type=stream,

  /dev/kmsg r,
  /dev/log w,
  /dev/syslog w,
  /dev/tty10 rw,
  /dev/xconsole rw,
  /etc/machine-id r,
  /etc/syslog-ng/* r,
  /etc/syslog-ng/conf.d/ r,
  /etc/syslog-ng/conf.d/* r,
  @{PROC}/kmsg r,
  /etc/hosts.deny r,
  /etc/hosts.allow r,
  /{usr/,}sbin/syslog-ng mr,
  /sys/devices/system/cpu/online r,
  /usr/share/syslog-ng/** r,

  /usr/lib/syslog-ng/** r,
  /usr/lib64/syslog-ng/** r,
  /usr/share/include/scl/** r,


  /var/lib/syslog-ng/syslog-ng-?????.qf rw,
  # chrooted applications
  @{CHROOT_BASE}/var/lib/*/dev/log w,
  @{CHROOT_BASE}/var/lib/syslog-ng/syslog-ng.persist* rw,
  @{CHROOT_BASE}/var/log/** w,
  @{CHROOT_BASE}/{,var/}run/syslog-ng.pid krw,
  @{CHROOT_BASE}/{,var/}run/syslog-ng.ctl rw,

  @{CHROOT_BASE}/usr/lib/syslog-ng/** r,
  @{CHROOT_BASE}/usr/lib64/syslog-ng/** r,
  @{CHROOT_BASE}/usr/share/include/scl/** r,

  /{var,var/run,run}/log/journal/ r,
  /{var,var/run,run}/log/journal/*/ r,
  /{var,var/run,run}/log/journal/*/*.journal r,
  /{var/,}run/syslog-ng.ctl a,
  /{var/,}run/syslog-ng/additional-log-sockets.conf r,

  # Site-specific additions and overrides. See local/README for details.
  #include <local/sbin.syslog-ng>
}

NOTE 1: I edited this because I tried the below solution, I added /dev/kmsg r, to the list of permissions syslog-ng requires and ended up with the same problem. I should also note that I am on funtoo/gentoo linux with a squashfs root backed by an EXT4 overlayfs. I will check the output of strace.

NOTE 2: I ran strace and am not seeing anything obvious, I'm using strace syslog-ng. If I comment out the problem in the syslog-ng.conf configuration file, it then stumbles on destination. Both of those should be supported in /usr/lib64/syslog-ng/** r, right?

strace (truncated):

access("/etc/syslog-ng/scl/*/*.conf", F_OK) = -1 ENOENT (No such file or directory)
access("/usr/share/include/scl/*/*.conf", F_OK) = -1 ENOENT (No such file or directory)
open("/etc/syslog-ng/scl", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
open("/usr/share/include/scl", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = -1 EACCES (Permission denied)
write(2, "[2017-12-25T11:13:53.068758] Err"..., 128[2017-12-25T11:13:53.068758] Error processing path for inclusion; path='/usr/share/include/scl', errno='Permission denied (13)'
) = 128
write(2, "[2017-12-25T11:13:53.068790] Fin"..., 94[2017-12-25T11:13:53.068790] Finishing include; filename='/etc/syslog-ng/scl.conf', depth='1'
) = 94
close(11)                               = 0
write(2, "[2017-12-25T11:13:53.068844] Rea"..., 93[2017-12-25T11:13:53.068844] Reading path for candidate modules; path='/usr/lib64/syslog-ng'
) = 93
open("/usr/lib64/syslog-ng", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = -1 EACCES (Permission denied)
open("/usr/lib64/charset.alias", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/lib64/gconv/gconv-modules.cache", O_RDONLY) = 11
fstat(11, {st_mode=S_IFREG|0644, st_size=26244, ...}) = 0
mmap(NULL, 26244, PROT_READ, MAP_SHARED, 11, 0) = 0x7f1df6c84000
close(11)                               = 0
futex(0x7f1df62928e8, FUTEX_WAKE_PRIVATE, 2147483647) = 0
futex(0x7f1df67c0428, FUTEX_WAKE_PRIVATE, 2147483647) = 0
futex(0x7f1df67c0428, FUTEX_WAKE_PRIVATE, 2147483647) = 0
open("/proc/self/maps", O_RDONLY|O_CLOEXEC) = 11
fstat(11, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0
read(11, "00400000-00402000 r-xp 00000000 "..., 1024) = 1024
read(11, "r--p 00004000 fe:02 7236        "..., 1024) = 1024
read(11, "     /lib64/libdl-2.23.so\n7f1df4"..., 1024) = 1024
read(11, "                  /usr/lib64/lib"..., 1024) = 1024
read(11, "ib64/libgthread-2.0.so.0.4800.2\n"..., 1024) = 1024
read(11, "--p 00006000 fe:02 7273         "..., 1024) = 1024
read(11, "0 \n7f1df64b3000-7f1df65bf000 r-x"..., 1024) = 1024
close(11)                               = 0
write(2, "Error parsing source, source plu"..., 109Error parsing source, source plugin system not found in /etc/syslog-ng/syslog-ng.conf at line 24, column 14:
) = 109
open("/etc/syslog-ng/syslog-ng.conf", O_RDONLY) = 11
fstat(11, {st_mode=S_IFREG|0644, st_size=1498, ...}) = 0
read(11, "@version: 3.7\n#\n# Syslog-ng defa"..., 4096) = 1498
close(11)                               = 0
write(2, "\nsource src { system(); internal"..., 39
source src { system(); internal(); };
) = 39
write(2, " ", 1 )                        = 1
write(2, " ", 1 )                        = 1
write(2, " ", 1 )                        = 1
write(2, " ", 1 )                        = 1
write(2, " ", 1 )                        = 1
write(2, " ", 1 )                        = 1
write(2, " ", 1 )                        = 1
write(2, " ", 1 )                        = 1
write(2, " ", 1 )                        = 1
write(2, " ", 1 )                        = 1
write(2, " ", 1 )                        = 1
write(2, " ", 1 )                        = 1
write(2, " ", 1 )                        = 1
write(2, "^", 1^)                        = 1
write(2, "^", 1^)                        = 1
write(2, "^", 1^)                        = 1
write(2, "^", 1^)                        = 1
write(2, "^", 1^)                        = 1
write(2, "^", 1^)                        = 1
write(2, "\n", 1
)                       = 1
write(2, "\nsyslog-ng documentation: http:/"..., 156
syslog-ng documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng
) = 156
close(10)                               = 0
exit_group(1)                           = ?
+++ exited with 1 +++

syslog-ng.conf:

@version: 3.7
@include "scl.conf"

options { 
        threaded(yes);
        chain_hostnames(no);
        stats_freq(43200);
        mark_freq(3600); 
};

source src { system(); internal(); };

destination messages { file("/var/log/messages" owner("logstash") group("logstash"));};
log { source(src); destination(messages); };
destination remote_log_server {udp("router" port(514));};
log { source(src); destination(remote_log_server); };

nyronium · Accepted Answer · 2017-12-25 20:16:37Z

1

Unfortunately you haven't posted your syslog-ng config, so I'm just guessing here based on my own experience with this type of error.

The error message is a bit misleading. The current apparmor profile prevents syslog-ng from accessing several files. A common problem is/dev/kmsg, which is needed when using a source similar to this one:

source kernsrc {
    file("/proc/kmsg");
};

Even though the file should be accessed through /proc/kmsg, syslog-ng checks some conditions on /dev/kmsg before proceeding (checked with strace). As this file is not allowed to be read by syslog-ng, it fails to start.

I have already submitted this bug to the apparmor-profiles bugtracker here.

In the meantime, you can fix this by manually editing the profile to allow syslog-ng to read /dev/kmsg. Add this permission line somewhere to the list in the apparmor profile for syslog-ng, probably /etc/apparmor.d/sbin.syslog-ng:

/dev/kmsg r,

edited Dec 25, 2017 at 20:16

answered Dec 23, 2017 at 21:01

nyronium

1917 bronze badges

I tried this, but I get the same thing. I will run strace and see what I get.
– Walter
Dec 24, 2017 at 11:30
No luck with strace, I compared before and after output with strace and the only differences are the addresses and the final return code (1 versus 0). I'm no expert by strace, so maybe there is something else I need to check.
– Walter
Dec 24, 2017 at 12:05
I myself have checked by using strace syslog-ng -F -d -v, then search for any E* constants set by system calls, like EACCESS or similar. Also search for = -1
– nyronium
Dec 24, 2017 at 18:06
Besides that it would help if you'd post your config
– nyronium
Dec 24, 2017 at 18:08
I added the strace output and my syslog conf. I see a bunch of permission denied and even tried to manually add the directory to the app armor config, but that didn't change anything. The files are owned by root and syslog is running as root, right, at least that is what I see when listing the process.
– Walter
Dec 25, 2017 at 16:30

| Show 6 more comments

Stack Exchange Network

Cannot start syslog-ng when apparmor is running

1 Answer 1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged
apparmor
syslog-ng
.

Linked

Hot Network Questions

Cannot start syslog-ng when apparmor is running

1 Answer 1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged apparmorsyslog-ng.

Linked

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
apparmor
syslog-ng
.