For the record: With the current kernel it is sufficient to change $KLogPath to /proc/kmsg (in /etc/rsyslog.conf); it already does the right thing of starting as root, opening the fds, and dropping privs only afterwards (I get a fully working kern.log).
So the only thing we need to add there is the check if reading as user is allowed, and if it's not, to not drop privileges.
For the record: With the current kernel it is sufficient to change $KLogPath to /proc/kmsg (in /etc/rsyslog.conf); it already does the right thing of starting as root, opening the fds, and dropping privs only afterwards (I get a fully working kern.log).
So the only thing we need to add there is the check if reading as user is allowed, and if it's not, to not drop privileges.