case "$ACTION" in post) setcap cap_syslog+ep /usr/bin/nanoklogd chown -R root:socklog /var/log/socklog chmod 2750 /var/log/socklog/* ;; esac