syslog-ng.conf : option group(<gid>); does not work ( stable version )
Hi, in syslog-ng.conf man page it is said that the option group(gid); is used to set group on created logfiles. Im trying to use that and it does not work it is setting the group, not to the group I specify in that group() directive, but to the group syslog-ng runs as. Also, the man page specifies you have to enter the gid in the group() option but the syslog-ng daemon wont start when the gid is specified in its numeral form. It should be group(groupname); instead of group(gid); in the man page. Does the chgrp works only when syslog-ng is running as root ? If so, it is not a documented feature .. --------------------------------- Yahoo! FareChase - Search multiple travel sites in one click.
On 10/26/05, Yan M. <yannnick_m@yahoo.com> wrote:
Hi, in syslog-ng.conf man page it is said that the option group(gid); is used to set group on created logfiles. Im trying to use that and it does not work it is setting the group, not to the group I specify in that group() directive, but to the group syslog-ng runs as. Also, the man page specifies you have to enter the gid in the group() option but the syslog-ng daemon wont start when the gid is specified in its numeral form. It should be group(groupname); instead of group(gid); in the man page. Does the chgrp works only when syslog-ng is running as root ? If so, it is not a documented feature ..
I suppose it's not documented because it's a standard UNIX security measure to not allow non-root users to create files belonging to other users. This would allow users to get around quotas and do other nefarious things. I do agree that if it's not in the docs, that this should be added. To work around it you'll need to either run syslog-ng as root and assign file ownership to another user (less desirable) or create it with explicit file permissions that allow the users/groups that you desire to see it (more desirable).
From the chgrp man page in Solaris :
To change the group ID of a file, the process must be the owner of the file and the new group ID must be the group of the process ID or must be in the supplementary group list of the process. So if the user has which the syslog-ng process is in the supplementary group to which I want to change ownership of the file to, it should work. It works in a shell. catenate <infosec@gmail.com> wrote: On 10/26/05, Yan M. <yannnick_m@yahoo.com> wrote:Hi, in syslog-ng.conf man page it is said that the option group(gid); is used to set group on created logfiles. Im trying to use that and it does not work it is setting the group, not to the group I specify in that group() directive, but to the group syslog-ng runs as. Also, the man page specifies you have to enter the gid in the group() option but the syslog-ng daemon wont start when the gid is specified in its numeral form. It should be group(groupname); instead of group(gid); in the man page. Does the chgrp works only when syslog-ng is running as root ? If so, it is not a documented feature .. I suppose it's not documented because it's a standard UNIX security measure to not allow non-root users to create files belonging to other users. This would allow users to get around quotas and do other nefarious things. I do agree that if it's not in the docs, that this should be added. To work around it you'll need to either run syslog-ng as root and assign file ownership to another user (less desirable) or create it with explicit file permissions that allow the users/groups that you desire to see it (more desirable). _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html --------------------------------- Yahoo! FareChase - Search multiple travel sites in one click.
On 10/27/05, Yan M. <yannnick_m@yahoo.com> wrote:
From the chgrp man page in Solaris : To change the group ID of a file, the process must be the owner of the file and the new group ID must be the group of the process ID or must be in the supplementary group list of the process. So if the user has which the syslog-ng process is in the supplementary group to which I want to change ownership of the file to, it should work. It works in a shell.
For some reason I read it as you trying to give away file ownership, not group ownership. I just verified this behavior you describe on Solaris 8. The same config does set the group perms as specified when running as root, but when running as a non-root user the group ownership is always the primary group of the user that the process is running as. Balazs?
On Thu, 2005-10-27 at 20:24 -0700, catenate wrote:
On 10/27/05, Yan M. <yannnick_m@yahoo.com> wrote: From the chgrp man page in Solaris :
To change the group ID of a file, the process must be the owner of the file and the new group ID must be the group of the process ID or must be in the supplementary group list of the process.
So if the user has which the syslog-ng process is in the supplementary group to which I want to change ownership of the file to, it should work. It works in a shell.
For some reason I read it as you trying to give away file ownership, not group ownership. I just verified this behavior you describe on Solaris 8. The same config does set the group perms as specified when running as root, but when running as a non-root user the group ownership is always the primary group of the user that the process is running as.
Specify the userid as well to the user you want to own the files. syslog-ng does chown/chgrp at the same time, and if one fails the other fails too. Alternatively apply this patch, which separates user/group setting to separate calls, so they become independent. Index: affile.c =================================================================== RCS file: /var/cvs/syslog-ng/syslog-ng/src/affile.c,v retrieving revision 1.61.4.3 diff -u -r1.61.4.3 affile.c --- affile.c 5 Aug 2004 11:35:12 -0000 1.61.4.3 +++ affile.c 28 Oct 2005 10:18:51 -0000 @@ -127,8 +127,10 @@ } *fd = open((char *) name->data, flags, mode); } - if (uid != -1 || gid != -1) - chown((char *) name->data, uid, gid); + if (uid != -1) + chown((char *) name->data, uid, -1); + if (gid != -1) + chown((char *) name->data, -1, gid); if (mode != -1) chmod((char *) name->data, mode); return *fd != -1; -- Bazsi
participants (3)
-
Balazs Scheidler
-
catenate
-
Yan M.