From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.io/gmane.comp.sysutils.supervision.general/1237 Path: news.gmane.org!not-for-mail From: Vincent Danen Newsgroups: gmane.comp.sysutils.supervision.general Subject: Re: svlogd and umask settings Date: Fri, 15 Sep 2006 09:22:26 -0600 Organization: Annvix Message-ID: <20060915152226.GI18873@annvix.org> References: <20060830220325.GK25489@annvix.org> <20060901174940.GY25489@annvix.org> <20060915144744.18045.qmail@3430f19bcf16f5.315fe32.mid.smarden.org> NNTP-Posting-Host: main.gmane.org Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="pTYhUwqpXRR/mkN7" X-Trace: sea.gmane.org 1158333844 4312 80.91.229.2 (15 Sep 2006 15:24:04 GMT) X-Complaints-To: usenet@sea.gmane.org NNTP-Posting-Date: Fri, 15 Sep 2006 15:24:04 +0000 (UTC) Original-X-From: supervision-return-1473-gcsg-supervision=m.gmane.org@list.skarnet.org Fri Sep 15 17:24:03 2006 Return-path: Envelope-to: gcsg-supervision@gmane.org Original-Received: from antah.skarnet.org ([212.85.147.14]) by ciao.gmane.org with smtp (Exim 4.43) id 1GOFWv-0003T6-6D for gcsg-supervision@gmane.org; Fri, 15 Sep 2006 17:23:03 +0200 Original-Received: (qmail 28163 invoked by uid 76); 15 Sep 2006 15:23:22 -0000 Mailing-List: contact supervision-help@list.skarnet.org; run by ezmlm List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Archive: Original-Received: (qmail 28154 invoked from network); 15 Sep 2006 15:23:22 -0000 Original-To: supervision@list.skarnet.org Content-Disposition: inline In-Reply-To: <20060915144744.18045.qmail@3430f19bcf16f5.315fe32.mid.smarden.org> X-Mailer: Mutt 1.5.x/OS X 10.4.x X-PGP-Key: http://linsec.ca/vdanen.asc X-URL: http://annvix.org/ User-Agent: Mutt/1.5.10i X-SA-Exim-Connect-IP: 68.149.37.7 X-SA-Exim-Mail-From: vdanen@annvix.org X-Spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) on hades.annvix.org X-Spam-Level: X-Spam-Status: No, score=-4.4 required=6.0 tests=ALL_TRUSTED,BAYES_00 autolearn=ham version=3.1.0 X-SA-Exim-Version: 4.2 (built Wed, 01 Feb 2006 18:29:36 -0700) X-SA-Exim-Scanned: Yes (on hades.annvix.org) Xref: news.gmane.org gmane.comp.sysutils.supervision.general:1237 Archived-At: --pTYhUwqpXRR/mkN7 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable * Gerrit Pape [2006-09-15 14:47:44 +0000]: > > > I have an issue with svlogd where I need it to write files with 0640 > > > perms, but it wants to write with 0644 perms. I tried to toss a umask > > > call in my runscript: >=20 > > > This doesn't seem to make a difference to svlogd. Looking in the > > > manpage, I didn't see anything about changing the permissions of files > > > it creates. But even with the above I get: > > >=20 > > > [root@ares apparmor.d]# ls -l /var/log/system/audit/ > > > total 0 > > > -rw-r--r-- 1 root root 0 Aug 30 16:17 current > > > -rw------- 1 root root 0 Aug 30 16:17 lock > > >=20 > > > What am I missing or do I have to change something in svlogd itself? > > > Since Annvix is now using socklog by default, I need to make sure logs > > > are 0640. The directory permissions are correct, but the log file > > > permissions are not. > >=20 > > Ok, I see the problem. I see all the fchmod() calls in svlogd.c that > > are writing files as mode 0744 or 0644. What would be nice to see is if > > svlogd could be configured to accept as a config option perms for files > > or if it respected umask settings. As it stands right now, I'm going to > > have to patch svlogd.c to make it write files mode 0740 or 0640. >=20 > Yes, this is compiled in. >=20 > > In conjunction with stuff like socklog, this is pretty important. You > > never see stuff like /var/log/messages or /var/log/auth.log with such > > insecure permissions so it would be good if something that socklog > > depended on could likewise write more secure log files. >=20 > Isn't it enough to set restrictive permissions on the directory? svlogd > won't touch these settings. I could, yes, but it just seems wrong to me. =3D) I do already have restrictive settings on the parent directories, and having looked at it, it does look well enough (ie. keeps the snoopers out). I'm trying to have everything write with the correct perms, however, and not rely on other things because while svlogd may not change the perms on the parent directory, a dumb admin might and I'm aiming to protect dumb admins from themselves. --=20 {FEE30AD4 : 7F6C A60C 06C2 4811 FA1C A2BC 2EBC 5E32 FEE3 0AD4} mysql> SELECT * FROM users WHERE clue > 0; Empty set (0.00sec) --pTYhUwqpXRR/mkN7 Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (Darwin) iD8DBQFFCsUyLrxeMv7jCtQRAvMcAJ9P3RjXGZBlR3WlYHO+aStWgDizgQCdFIp9 D5jPCmf09t776gOMLBSAVpc= =DFKY -----END PGP SIGNATURE----- --pTYhUwqpXRR/mkN7--