case "$ACTION" in post) setcap cap_syslog+ep usr/bin/nanoklogd chown -R root:socklog var/log/socklog chmod 2750 var/log/socklog/* ;; esac