upstart log file permissions are too paranoid

[Jens Elkner]

The current upstart log file permissions are too paranoid 0640 and there is no documented way, how to change it (either the mode or ownership). So it is ridiculous to give user super user permissions, just for being able to read such files. So either make upstart to use mode 0644 or provide a mechanism that let an admin choose the level of paranoia.

[harrychillboy (harrychillboy)]

In most companies SysAdmins install upstart jobs but dev need to read it to find issues / errors. With this restriction either the dev need to have root permission or sysadmin need to copy the logs to other directory.

I understand the security restrictions but there should be a way to allow other system users to read the logs

[Darren Spruell (phatbuckett)]

Would like to add support to this - it would be nice for standard behavior to be the default (restrictive permissions to log files), but with possibility to override globally or per service (via job configuration) what the owner/group and file mode should be.

Another option could be to default to making the group owner of Upstart log files a group like 'adm' or 'operator', enabling the sysadmin to grant access via group membership.