Re: svlogd and umask settings

[Gerrit Pape <pape@smarden.org>]

On Fri, Sep 01, 2006 at 11:49:40AM -0600, Vincent Danen wrote:
> * Vincent Danen <vdanen@linsec.ca> [2006-08-30 16:03:25 -0600]:
> > I have an issue with svlogd where I need it to write files with 0640
> > perms, but it wants to write with 0644 perms.  I tried to toss a umask
> > call in my runscript:

> > This doesn't seem to make a difference to svlogd.  Looking in the
> > manpage, I didn't see anything about changing the permissions of files
> > it creates.  But even with the above I get:
> > 
> > [root@ares apparmor.d]# ls -l /var/log/system/audit/
> > total 0
> > -rw-r--r--  1 root root 0 Aug 30 16:17 current
> > -rw-------  1 root root 0 Aug 30 16:17 lock
> > 
> > What am I missing or do I have to change something in svlogd itself?
> > Since Annvix is now using socklog by default, I need to make sure logs
> > are 0640.  The directory permissions are correct, but the log file
> > permissions are not.
> 
> Ok, I see the problem.  I see all the fchmod() calls in svlogd.c that
> are writing files as mode 0744 or 0644.  What would be nice to see is if
> svlogd could be configured to accept as a config option perms for files
> or if it respected umask settings.  As it stands right now, I'm going to
> have to patch svlogd.c to make it write files mode 0740 or 0640.

Yes, this is compiled in.

> In conjunction with stuff like socklog, this is pretty important.  You
> never see stuff like /var/log/messages or /var/log/auth.log with such
> insecure permissions so it would be good if something that socklog
> depended on could likewise write more secure log files.

Isn't it enough to set restrictive permissions on the directory?  svlogd
won't touch these settings.

Regards, Gerrit.