Package: jetty9 Version: 9.4.58-2
Severity: normal Subject: jetty9: LogsDirectory= changes /var/log/jetty9 group from adm to jetty The package currently uses two conflicting mechanisms to manage the ownership of the log directory. The tmpfiles configuration installs the directory as: ``` d /var/log/jetty9 0750 jetty adm Z /var/log/jetty9 - jetty adm ``` which clearly specifies that the directory group should be "adm". However, the systemd service contains: ``` User=jetty Group=jetty LogsDirectory=jetty9 ``` According to the systemd.exec(5) documentation, LogsDirectory= ensures that the innermost directory is owned by the User= and Group= configured for the service. As a result, when the service starts, systemd changes the ownership of: ``` /var/log/jetty9 ``` from: ``` jetty:adm ``` to: ``` jetty:jetty ``` The package previously managed directory ownership in postinst, but starting with version 9.4.58-2 this logic has been migrated to systemd-tmpfiles while LogsDirectory= has been kept unchanged. The packaging therefore contains two contradictory ownership definitions for the same directory: * debian/jetty9.tmpfiles expects: jetty:adm * debian/jetty9.service (via LogsDirectory=) enforces: jetty:jetty I could not find any packaging logic that restores the "adm" group after the service starts: * postinst no longer changes ownership of /var/log/jetty9; * no ExecStartPre= hook performs a corrective chown; * no ACLs are installed; * no other packaging scripts modify the directory ownership. Therefore, unless systemd has changed the semantics of LogsDirectory=, starting the service will overwrite the ownership established by tmpfiles.d. I believe the package should use only one ownership mechanism, or both mechanisms should agree on the expected ownership. Possible fixes include either: * changing the tmpfiles entry to use group "jetty" if that is the intended ownership; or * avoiding LogsDirectory= if the intended group is "adm". The current packaging is internally inconsistent and causes the configured ownership of /var/log/jetty9 to change depending on whether tmpfiles or systemd processed the directory most recently.
__ This is the maintainer address of Debian's Java team <https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-java-maintainers>. Please use [email protected] for discussions and questions.
