Bug#925929: LogsDirectory vs. group adm

2019-04-01 Thread Thorsten Glaser
On Mon, 1 Apr 2019, Felipe Sateler wrote: > Thanks for linking to the full file. I had not noticed that the unit used a > specific User. This means a root-owned /var/log/tomcat9 is not going to be > writable by tomcat. You should probably set it to tomcat9:adm, or add an Oops, yes, tomcat:adm is

Bug#925929: LogsDirectory vs. group adm

2019-04-01 Thread Felipe Sateler
Hi, On Mon, Apr 1, 2019 at 8:36 AM Thorsten Glaser wrote: > Hi again Felipe, > > > If you ship this, there is no need for a LogsDirectory= entry. > > But I probably do need to add it with ReadWritePaths if we use > ProtectSystem=strict, correct? > Correct. > > >

Bug#925929: LogsDirectory vs. group adm

2019-04-01 Thread Thorsten Glaser
Hi again Felipe, > If you ship this, there is no need for a LogsDirectory= entry. But I probably do need to add it with ReadWritePaths if we use ProtectSystem=strict, correct? https://salsa.debian.org/java-team/tomcat9/commit/5556481b345049f32720e20d22a072ebd9b865fa Thanks, //mirabilos --

Bug#925929: LogsDirectory vs. group adm

2019-03-29 Thread Thorsten Glaser
On Fri, 29 Mar 2019, Felipe Sateler wrote: > It might be a good idea to store that script somewhere else (possibly > /usr/lib/tomcat9 ?) and call it from the init script. As the script gets Indeed… the systemd unit calls the scripts from /usr/libexec/tomcat9/ (which is the currently recommended

Bug#925929: LogsDirectory vs. group adm

2019-03-29 Thread Felipe Sateler
On Fri, Mar 29, 2019 at 6:12 PM Thorsten Glaser wrote: > Hi Felipe, > > > > This won’t delete the logs on shutdown or something, because > > > it’s called tmpfiles? > > > > No, because we don't provide the last argument (the age one): > > thanks! > Glad to help. > > > In fact, /var/log is

Bug#925929: LogsDirectory vs. group adm

2019-03-29 Thread Thorsten Glaser
Hi Felipe, > > This won’t delete the logs on shutdown or something, because > > it’s called tmpfiles? > > No, because we don't provide the last argument (the age one): thanks! > In fact, /var/log is already tmpfile'd with a similar entry: OK. I don’t run systemd, so I didn’t know and needed

Bug#925929: LogsDirectory vs. group adm

2019-03-29 Thread Felipe Sateler
On Fri, Mar 29, 2019 at 5:17 PM Thorsten Glaser wrote: > Hi Felipe, > > > You can ship a tmpfiles snippet like: > > > > d /var/log/tomcat9 2750 root adm - > > This won’t delete the logs on shutdown or something, because > it’s called tmpfiles? > No, because we don't provide the last argument

Bug#925929: LogsDirectory vs. group adm

2019-03-29 Thread Thorsten Glaser
Hi Felipe, > You can ship a tmpfiles snippet like: > > d /var/log/tomcat9 2750 root adm - This won’t delete the logs on shutdown or something, because it’s called tmpfiles? > If you ship this, there is no need for a LogsDirectory= entry. Thanks, //mirabilos -- tarent solutions GmbH

Bug#925929: LogsDirectory vs. group adm

2019-03-29 Thread Felipe Sateler
Hi Thorsten, On Fri, Mar 29, 2019 at 1:17 PM Thorsten Glaser wrote: > Hi, > > how can we make it so that a service that uses LogsDirectory > has its logs readable by group adm? > > There is “LogsDirectoryMode=750” which we could change to 2750, > but no way to set the group to adm, and from

Bug#925929: LogsDirectory vs. group adm

2019-03-29 Thread Thorsten Glaser
Hi, how can we make it so that a service that uses LogsDirectory has its logs readable by group adm? There is “LogsDirectoryMode=750” which we could change to 2750, but no way to set the group to adm, and from what I’ve read, pre-creating the /var/log/tomcat9 (in this case) as 2750 tomcat:adm