Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make default file permissions more restrictive #83

Merged
merged 1 commit into from
Apr 11, 2019

Conversation

JAORMX
Copy link
Contributor

@JAORMX JAORMX commented Apr 11, 2019

This asures that the process can still read and write its own log file,
but that other users cannot. This is a fairly standard mode for log
files in linux.

This addresses #82

This asures that the process can still read and write its own log file,
but that other users cannot. This is a fairly standard mode for log
files in linux.
@natefinch natefinch merged commit 2e8fbee into natefinch:v2.0 Apr 11, 2019
xukgo pushed a commit to xukgo/lumberjack that referenced this pull request Mar 5, 2020
This asures that the process can still read and write its own log file,
but that other users cannot. This is a fairly standard mode for log
files in linux.
crabio added a commit to crabio/woodpecker that referenced this pull request Aug 22, 2021
* v2 is go!

* update readme and mention gopkg.in in godoc

* remove travis.yml, update badges, use drone.io for builds

* fix link in badge

* fix link in badge

* comment to make MaxAge units more obvious

* fix a spot where an error was not properly returned

* add changes to maintain perms and owner of logfile

* fix test failures on windows

* Update README.md

add badge for windows build

* Fixed import in example test to use gopkg.in.

* Fix bug natefinch#12

Fixes bug natefinch#12. If the first write to a file would cause it to rotate, instead
of rotating, we'd just move it aside.  This change fixes that problem
by ensuring that we just run rotate in this situation, which does the
right thing (open new and then cleanup.)  Also added test to verify
the fix.

* add coverage badge

* Switch to using gopkg.in/yaml.v2

* Update rotate_test.go to use v2 of project

Hi there.  I thought it would be nice for the rotate example to use v2 of the package.

* Use gopkg.in provider instead of github

* fix filemode in tests (natefinch#28)

This fixes natefinch#20 by using a more restrictive filemode during tests.

* update docs w/ backup format info

* Add support for log file compression (natefinch#43)

* Check test file content, not just length.

It is insufficient to just check the length of test files,
especially given that many of the tests result in multiple files
that have the same content/length. Instead, actually check that
the file content is what it is expected to be. Vary the content
that is being written so that the test failures become apparent.

This also fixes a case where the length of the wrong value is
checked following a write (it happens to work since the length
of the value checked is the same as that written).

* Make timeFromName actually return a time.

Simplify the timeFromName parsing (we only need to slice once,
not twice) and actually parse the extracted time in the
timeFromName function rather than returning an abitrary string
that may or may not be a time. Also conver the timeFromName
tests into table driven tests.

* Add support for compressing log files.

Rather than scanning for old log files (under lock) when a rotation
occurs, a goroutine is started when we first open or create a log
file. Post-rotation compression (if enabled) and removal of stale
log files is now designated to this goroutine.

Scanning, removal and compression are run in the same goroutine in
order to minimise background disk I/O, with removals being processed
prior to compression in order to free up disk space.

This results in a small change in existing behaviour - previously
only logs would be removed when the first rotation occurs, whereas
now logs will potentially be removed when logging first starts.

* Rework file ownership test.

Previously the test only verified that the code called Chown
but failed to verify what it actually called Chown on. This
reworks the code so that we have a fake file system that tracks
file ownership.

This also simplifies upcoming additional tests.

* Clone file owner and mode on compressed log.

Clone the log file owner and the log file mode to the compressed
log file. Add tests to ensure that this is handled correctly.

* switch to travis (natefinch#44)

* Update docs, adding `Compress` setting details (natefinch#49)

* Fix test timing (natefinch#64)

fix test timeout on CI

* Make default file permissions more restrictive (natefinch#83)

This asures that the process can still read and write its own log file,
but that other users cannot. This is a fairly standard mode for log
files in linux.

* fix a typo (natefinch#62)

* use 0755 to create new dir (natefinch#68)

* cleanup and module support (natefinch#77)

* cleanup and module support

* add rotate everyday

* remove unused code in unit tests

* fix rotate everyday

Co-authored-by: Nate Finch <nate.finch@gmail.com>
Co-authored-by: Matt Silverlock <matt@eatsleeprepeat.net>
Co-authored-by: Martin Packman <martin.packman@canonical.com>
Co-authored-by: Tim Potter <tpot@samba.org>
Co-authored-by: Joel Sing <joel@sing.id.au>
Co-authored-by: Tyler Butters <dapegral@gmail.com>
Co-authored-by: Juan Osorio Robles <jaosorior@gmail.com>
Co-authored-by: 康晓宁 <kxnmei@163.com>
Co-authored-by: Deen <englanq@126.com>
Co-authored-by: Lukas Rist <glaslos@gmail.com>
chancez added a commit to chancez/lumberjack that referenced this pull request Mar 11, 2022
This reverts commit 2e8fbee.

Signed-off-by: Chance Zibolski <chance.zibolski@gmail.com>
chancez added a commit to cilium/lumberjack that referenced this pull request Mar 14, 2022
This reverts commit 2e8fbee.

These permissions do not allow other containers to read the files as
needed, so revert the permissions change until we decide this should be
configurable.

Signed-off-by: Chance Zibolski <chance.zibolski@gmail.com>
chancez added a commit to cilium/lumberjack that referenced this pull request Mar 14, 2022
* cilium/v2.0:
  cleanup and module support (natefinch#77)
  use 0755 to create new dir (natefinch#68)
  fix a typo (natefinch#62)
  Make default file permissions more restrictive (natefinch#83)
  Fix test timing (natefinch#64)
  Update docs, adding `Compress` setting details (natefinch#49)
  switch to travis (natefinch#44)
  Add support for log file compression (natefinch#43)

Signed-off-by: Chance Zibolski <chance.zibolski@gmail.com>
chancez added a commit to cilium/lumberjack that referenced this pull request Mar 14, 2022
This reverts commit 2e8fbee.

These permissions do not allow other containers to read the files as
needed, so revert the permissions change until we decide this should be
configurable.

Signed-off-by: Chance Zibolski <chance.zibolski@gmail.com>
@mattsoftware
Copy link

Any chance we can get this patch tagged and released? I am currently using aws/amazon-cloudwatch-agent which imports this utitity as gopkg.in/natefinch/lumberjack.v2 v2.0.0 which has overly permissive logfiles. This patch will fix that. Hopefully we can do a v2.0.1 or a v2.1 release?

Thank you

mmetc added a commit to crowdsecurity/crowdsec that referenced this pull request Jun 7, 2023
The lumberjack package fixed the issue in natefinch/lumberjack#83 (tested with umask 002) and this code is now redundant since we updated the dependency to v2.2.1.
mmetc added a commit to crowdsecurity/crowdsec that referenced this pull request Jun 9, 2023
The lumberjack package fixed the issue in natefinch/lumberjack#83 (tested with umask 002) and this code is now redundant since we updated the dependency to v2.2.1.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants