Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

My application requires read access to /var/log/messages, which belongs to user and group root. What is the minimal exposure level required on /var/log/messages so my application can read it?

Presently, my plan is to change the group ownership of /var/log/messages to a new group, and add root and my application user to it, but this would also give the application write privileges to /var/log/messages.

OS: Centos 5.5

share|improve this question

4 Answers 4

up vote 4 down vote accepted

No need to add root to the group as it will have access via the user privs anyways, just give group read to what ever group you decide. Remember to make the changes with logrotate as well or the group changes will get wiped nightly.

share|improve this answer
    
Where are the logrotate scripts located? –  gAMBOOKa Apr 12 '11 at 16:08
1  
/etc/logrotate.d/ is the folder for the broken out logrotate scripts. /var/log/messages is in /etc/logrotate.d/syslog. You would need to move /var/log/messages to it's own file inside /etc/logrotate.conf and then using something like 'create 0640 root new_group' tell it to create the file properly. –  rfelsburg Apr 12 '11 at 16:10

Your plan is acceptable and in the "traditional" Unix permissions scheme is the best way to go.
Another option is to have syslog divert the messages of interest to another file (which avoids giving the app user access to anything sensitive that may be in /var/log/messages).

If you don't feel like being bound by the traditional permissions scheme of User/Group/Other you can also use POSIX ACLs (other, possibly better howtos/info available via Google) to give your app user read-only access to /var/log/messages -- this is a bit more fine-grained and doesn't risk accidentally putting someone else in the application's group and giving them access to things they shouldn't be able to see.

share|improve this answer

Yip ive used setfacl to do this to give access to the mail.log file for a customer, not you will also need to stick a command in the logrotate.conf file to re-set the acl after the logs have been rotated eg:

postrotate /usr/bin/setfacl -m o::r /var/log/mail.log endscript

Note ive only just set this up, and have not tested, but though it would post back here, cant see why it wouldnt work, someone correct me if im wrong.

share|improve this answer

You can use ACL for this. It allows you to set specific additional access rules for specific users and files.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.