© 2004
Canonical Ltd.
•
Terms of use
•
Data privacy
•
Contact Launchpad Support
•
Blog
•
Careers
•
System status
•
bbfa235
(Get the code!)
In Ubuntu, we use the $PrivDropToUser and $PrivDropToGroup to reduce rsyslog privileges. However, this in practice means that we need to also set $FileOwner to the same values and make sure that all existing output log files are already set to the right values (since FileOwner only applies to new files).
If we don't do this, a HUP stops output, since rsyslog won't be able to open its own output files.
I like how when PrivDropToUser is enabled, a HUP is automatically forced to be lightweight. Could something similar be done here? Where if the user enables PrivDropToUser, FileOwner gets set to the same value. Though, whether this needs to be done really depends on FileCreateMode, so maybe forcing it doesn't make sense after all.
Additionally, could a configuration value like $FileChown (bool) be added? This would tell rsyslog to chown all output files upon open, if they're new or old. This could also be forced on when PrivDropTo* is used, modulo the FileCreateMode comment above.
In the meantime, I can just patch the Ubuntu code to always chown, without the benefit of a config value.