0

So I'm trying to run Supervisor (http://supervisord.org/) as a non-root user. However the process outputs logs to the /var/log directory which is owned by root and has 755 permissions. Therefore starting the process as a non-root user throws a permission denied error. What is a best practice for solving this issue? One idea I have is to recursively change the group of the /var directory to that of the user which is starting the supervisor process, and giving the /var directory 775 permissions. Is this acceptable from a security standpoint?

3 Answers 3

4

Try creating the log files and using chown to change the ownership to the appropriate user. If possible change the log location to a subdirectory owned by the appropriate user.

I use logrotate to rotate logs periodically. It can handle permissions when rotating logs.

4
  • So you will typically move the logs to a subdirectory of that user's home? May 25, 2013 at 3:03
  • 1
    I would move the logs to a subdirectory of /var/log. In this case /var/log/supervisord.
    – BillThor
    May 25, 2013 at 3:12
  • But doesn't that user need permissions to access /var/log then? May 25, 2013 at 3:30
  • No, the user just needs write access to /var/log/supervisord.
    – BillThor
    May 25, 2013 at 3:34
2

Use the user= directive in supervisord.conf, so that supervisord starts as root, does any necessary opening of files, and then drops privileges.

7
  • How do I get supervisord to drop privileges? May 25, 2013 at 0:41
  • By setting the user parameter, as I just said. May 25, 2013 at 0:41
  • but if I have user=root in the config file, doesn't the user remain as root? May 25, 2013 at 0:43
  • Why would you do that?! Aren't you trying to run it as a different user? May 25, 2013 at 0:44
  • I'm confused haha. Yes I do want to run it as a different user. Right now I have user=[non-root user] already and that is what's causing the problem May 25, 2013 at 0:45
0

If you haven't already, you could create a user specifically to run supervisord, and use an ACL to give that user write privileges in /var/log.

setfacl -m u:$USER:rwx /var/log

You can also do things like make your supervisord user a member of sys. (I think, I don't have a linux box nearby to verify that the /var/log group has write privileges.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .