I have found an additional packaging issue related to the permissions used for the Jetty log directory and log rotation.
### 1. `/var/log/jetty9` should be owned by `jetty:adm` with mode `0770` Even if the ownership problem caused by `LogsDirectory=` is addressed, the directory permissions themselves are still insufficient for the intended logging design. `rsyslog` runs as: ``` User: syslog Group: syslog Supplementary groups: adm ``` Therefore it does not need to become the owner of `/var/log/jetty9`, but it **does** require write permission through the `adm` group in order to create new log files. With the current packaging, the directory eventually becomes owned by `jetty:jetty` with mode `0750`, which completely prevents `rsyslog` from creating `jetty-console.log`. Even if the ownership is corrected back to `jetty:adm`, mode `0750` still leaves the group without write permission. For the logging configuration installed by the package to work correctly, the directory needs to be writable by members of the `adm` group. In practice this means ownership `jetty:adm` together with mode `0770`. ### 2. The logrotate configuration recreates the file with insufficient permissions There is another independent issue in the package's logrotate configuration. The installed configuration currently contains: ``` create 640 jetty adm ``` After every rotation, logrotate recreates `jetty-console.log` as: ``` -rw-r----- jetty:adm ``` At this point `rsyslog` is no longer the file owner, and accesses the file through its supplementary `adm` group membership. However, mode `0640` grants the group only read permission, so `rsyslog` can no longer append new log messages after the file has been recreated. Changing the directory permissions alone is therefore not sufficient to fix the problem. The recreated log file also needs to remain writable by the `adm` group. Using mode `0660` instead of `0640` preserves write access for `rsyslog` after every log rotation. I verified this locally by changing the installed logrotate configuration from: ``` create 640 jetty adm ``` to: ``` create 660 jetty adm ``` After this change, the recreated log file remained writable by `rsyslog`, and logging continued normally after rotation. __ This is the maintainer address of Debian's Java team <https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-java-maintainers>. Please use [email protected] for discussions and questions.
