I want to read the apache2 error log file from PHP (it is currently owned by the www-data user)

Is it safe to change the owner of this file, or to give it less restrictive permissions ?


The reason the default configuration is to restrict access to the error log is that it can contain sensitive information regarding either your configuration, or records of warnings/errors that contain usernames, passwords, database connection strings etc.

Allowing the webserver itself (read-only) access to that error log increases the risk for unauthorized access to such information.

But only you can do a risk analysis and judge if the benefits outweigh the risks.

  • I know it's raise up security issue. If I do change permission, what is going to happen with the log rotate ? – user2804112 Sep 4 '14 at 13:59
  • Unless you take specific measures, the log files get re-created after rotating them by reloading the apache server. That results in them getting default permissions. A create 0123 username groupname will create the new log files with specific permissions and owner before running the post rotate script, allowing you to override apache defaults. – HBruijn Sep 4 '14 at 14:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.