Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Subject: Re: tomat8.5 write logs with incorret os permission
To: users@tomcat.apache.org
References: <tencent_5FEF73702778712E062A5CF4@qq.com>
 <SN1PR0701MB18224BE272646BDF1D59A4CF97180@SN1PR0701MB1822.namprd07.prod.outlook.com>
 <tencent_4A13BC0B01FD805576D71F4E@qq.com>
From: =?UTF-8?Q?Andr=c3=a9_Warnier_=28tomcat=29?= <aw@ice-sa.com>
Message-ID: <57A4776D.50806@ice-sa.com>
Date: Fri, 5 Aug 2016 13:24:29 +0200
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:38.0) Gecko/20100101
 Thunderbird/38.5.0
MIME-Version: 1.0
In-Reply-To: <tencent_4A13BC0B01FD805576D71F4E@qq.com>
Content-Type: text/plain; charset=gb18030; format=flowed
Content-Transfer-Encoding: 8bit
archived-at: Fri, 05 Aug 2016 11:25:02 -0000

Hi.

On 05.08.2016 08:00, ² wrote:
>> Definitely a bad idea to relax the default permissions back to where they were.  If you want to expose your own system to abuse, you can set umask as documented in the changelog.
> Is there a way to like config some param to force tomcat write logs in old way ?and could you please give me a doc url about how set umask for tomcat run user 
>

You might want to start here :

http://lmgtfy.com/?q=linux+umask+command

Then, you may need to find out which command or shell script, *on your Linux system*, is 
starting Tomcat, and insert the desired umask command there.

But please consider the remarks made previously by Chuck.
Logfiles may contain information which you do not want to disclose to other than a system 
administrator.  By making these files widely readable, you weaken the security of your 
whole server and perhaps much more.

Be aware also, that by setting the umask for the Tomcat process, you are influencing the 
permissions of *any* file which Tomcat itself, or any Tomcat webapp would create.

>
>
>
> ------------------ Original ------------------
> From: "Caldarale, Charles R"<Chuck.Caldarale@unisys.com>;
> Date: 201685() 12:25
> To: "Tomcat Users List"<users@tomcat.apache.org>;
> Subject: RE: tomat8.5 write logs with incorret os permission
>
>
>
>> From: ² [mailto:jiucai@qq.com]
>> Subject: tomat8.5 write logs with incorret os permission
>
>> When using tomcat8.0, it starts and write logs as follows:
>> (apache-tomcat-8.0.x) -rw-rw-r-- 1 app app 873710 Aug  4 20:08 catalina.log
>> When using tomcat8.5.x (include tomcat 9.0.x), it starts and write logs as follows:
>> (apache-tomcat-8.5.4) -rw-r----- 1 app app 100824 Aug  4 20:10 catalina.log
>
> A highly appropriate change, much needed to prevent untrusted users from accessing private information in the log.
>
>> So, tomcat8.5 caused other os users can not read its logs and webapps logs that deployed
>> at tomcat8.5. the logs files should has permission 664, not 640.
>
> Definitely not a good idea.
>
>> I thinks it is not good for java webapp devlopers ,  when my web app write logs as
>> data log, the logs files can not rsync by other users and hosts.
>
> As it should be.
>
>> but it works at tomcat7.0.x and tomcat8.0.x
>
> "Works" is your definition; any site interested at all in secure operations would consider the old permissions to be dangerous and broken.
>
>> So I asked users to require further support for tomcat8.x write log files feature.
>
> Definitely a bad idea to relax the default permissions back to where they were.  If you want to expose your own system to abuse, you can set umask as documented in the changelog.
>
>   - Chuck
>
>
> THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org