With rsyslog 5.6.2 I tried to use UDP and TCP listeners on port 514 in combination with privilege drop. Config file contains:
$PrivDropToUser bulb $PrivDropToGroup bulb $Ruleset indata $RulesetCreateMainQueue on $InputTCPServerBindRuleset indata $InputTCPServerRun 514 $InputUDPServerBindRuleset indata $UDPServerRun 514 I get this error: rsyslogd: Could not create tcp listener, ignoring port 514. [try http://www.rsyslog.com/e/2077 ] strace shows: 28240 socket(PF_INET6, SOCK_DGRAM, IPPROTO_UDP) = 4 28240 setsockopt(4, SOL_IPV6, IPV6_V6ONLY, [1], 4) = 0 28240 setsockopt(4, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0 28240 uname({sys="Linux", node="ssm2.nat.myrio.net", ...}) = 0 28240 fcntl(4, F_GETFL) = 0x2 (flags O_RDWR) 28240 fcntl(4, F_SETFL, O_RDWR|O_NONBLOCK) = 0 28240 bind(4, {sa_family=AF_INET6, sin6_port=htons(514), inet_pton(AF_INET6, "::", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, 28) = 0 That was IPv6 UDP socket. 28240 socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP) = 5 28240 setsockopt(5, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0 28240 fcntl(5, F_GETFL) = 0x2 (flags O_RDWR) 28240 fcntl(5, F_SETFL, O_RDWR|O_NONBLOCK) = 0 28240 bind(5, {sa_family=AF_INET, sin_port=htons(514), sin_addr=inet_addr("0.0.0.0")}, 16) = 0 That was IPv4 UDP socket. 28241 setuid(1004) = 0 28241 futex(0x40bded1c, FUTEX_WAKE_PRIVATE, 1) = 0 28241 futex(0x7fffc9f38600, FUTEX_WAKE_PRIVATE, 1 <unfinished ...> 28240 <... futex resumed> ) = 0 28240 setuid(1004) = 0 That was privilege drop. 28243 socket(PF_INET6, SOCK_STREAM, IPPROTO_TCP) = 9 28243 setsockopt(9, SOL_IPV6, IPV6_V6ONLY, [1], 4) = 0 28243 setsockopt(9, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0 28243 fcntl(9, F_GETFL) = 0x2 (flags O_RDWR) 28243 fcntl(9, F_SETFL, O_RDWR|O_NONBLOCK) = 0 28243 bind(9, {sa_family=AF_INET6, sin6_port=htons(514), inet_pton(AF_INET6, "::", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, 28) = -1 EACCES (Permission denied) 28243 close(9) = 0 28243 socket(PF_INET, SOCK_STREAM, IPPROTO_TCP) = 9 28243 setsockopt(9, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0 28243 fcntl(9, F_GETFL) = 0x2 (flags O_RDWR) 28243 fcntl(9, F_SETFL, O_RDWR|O_NONBLOCK) = 0 28243 bind(9, {sa_family=AF_INET, sin_port=htons(514), sin_addr=inet_addr("0.0.0.0")}, 16) = -1 EACCES (Permission denied) Those were TCP sockets. Bind() fails because it happens after privilege drop. -- .-. .-. Yes, I am an agent of Satan, but my duties are largely (_ \ / _) ceremonial. | | [email protected] _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
