Role: Klog  has GET_STATUS_DATA on scd rsbac_log
/bin/ksyslog-ng has initial_role and force_role set to Klog
                and auth cap for 400

When root do: $ /sbin/start-stop-daemon -u secoff --start --exec /bin/ksyslog-ng -f /etc/syslog-ng/syslog-ng-rsbac.conf -u secoff -v
rsbac_adf_request(): request GET_STATUS_DATA, pid 9403, ppid 5537, prog_name ksyslog-ng, prog_file /sbin/ksyslog-ng, uid 0, target_type SCD, tid rsbac_log, attr none, value none, result NOT_GRANTED by FF AUTH

If role Klog have no right on scd rsbac_log :
check_comp_rc_scd(): pid 9556 (ksyslog-ng), owner 0, rc_role 5, scd_type 9, request GET_STATUS_DATA -> NOT_GRANTED!
rsbac_adf_request(): request GET_STATUS_DATA, pid 9556, ppid 5537, prog_name ksyslog-ng, prog_file /sbin/ksyslog-ng, uid 0, target_type SCD, tid rsbac_log, attr none, value none, result NOT_GRANTED by FF RC AUTH

If secoff launch start-stop-daemon, everything is fine

I think there is a special check for rsbac_log to verify if the uid == 400