So I'm trying to run Supervisor (http://supervisord.org/) as a non-root user. However the process outputs logs to the /var/log
directory which is owned by root and has 755 permissions. Therefore starting the process as a non-root user throws a permission denied error. What is a best practice for solving this issue? One idea I have is to recursively change the group of the /var
directory to that of the user which is starting the supervisor process, and giving the /var
directory 775 permissions. Is this acceptable from a security standpoint?
3 Answers
Try creating the log files and using chown
to change the ownership to the appropriate user. If possible change the log location to a subdirectory owned by the appropriate user.
I use logrotate
to rotate logs periodically. It can handle permissions when rotating logs.
-
So you will typically move the logs to a subdirectory of that user's home? May 25, 2013 at 3:03
-
1I would move the logs to a subdirectory of /var/log. In this case /var/log/supervisord.– BillThorMay 25, 2013 at 3:12
-
But doesn't that user need permissions to access
/var/log
then? May 25, 2013 at 3:30 -
Use the user=
directive in supervisord.conf
, so that supervisord starts as root, does any necessary opening of files, and then drops privileges.
-
-
-
but if I have
user=root
in the config file, doesn't the user remain asroot
? May 25, 2013 at 0:43 -
Why would you do that?! Aren't you trying to run it as a different user? May 25, 2013 at 0:44
-
I'm confused haha. Yes I do want to run it as a different user. Right now I have
user=[non-root user]
already and that is what's causing the problem May 25, 2013 at 0:45
If you haven't already, you could create a user specifically to run supervisord, and use an ACL to give that user write privileges in /var/log.
setfacl -m u:$USER:rwx /var/log
You can also do things like make your supervisord user a member of sys. (I think, I don't have a linux box nearby to verify that the /var/log group has write privileges.)