<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p>Hi Markus,</p>
<p><br>
</p>
<p>Please ignore my previous message about logrotate. It was my mistake that it did not work.</p>
<p><br>
</p>
<p>Would it be an acceptable solution if the fileOwner setting is removed from <span>
/etc/rsyslog.d/tomcat9.conf</span> and su setting is removed from <span>/etc/logrotate.d/tomcat9</span> file which are shipped with tomcat9 package?</p>
<p><br>
</p>
<p>This is the way rsyslog/logrotate configuration is done for some other packages that I checked.<br>
</p>
<p><br>
</p>
<p>Thanks,</p>
<p>Evren<span></span><br>
</p>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Evren Yurtesen<br>
<b>Sent:</b> Wednesday, April 20, 2022 12:18:57 PM<br>
<b>To:</b> Markus Koschany; Utkarsh Gupta<br>
<b>Cc:</b> 1008668@bugs.debian.org<br>
<b>Subject:</b> Re: bug #1008668: tomcat9: logrotated is not able to truncate catalina.out</font>
<div> </div>
</div>
<div><style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p>Nevermind my previous idea. It does not work as the /var/log/tomcat9 is group writable by `adm` group. Causes the following problem: :(</p>
<p><br>
</p>
<p></p>
<div># logrotate -f /etc/logrotate.d/tomcat9<br>
error: skipping "/var/log/tomcat9/catalina.out" because parent directory has insecure permissions (It's world writable or writable by group which is not "root") Set "su" directive in config file to tell logrotate which user/group should be used for rotation.</div>
<br>
<p></p>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Evren Yurtesen<br>
<b>Sent:</b> Thursday, April 14, 2022 10:39:58 PM<br>
<b>To:</b> Markus Koschany; Utkarsh Gupta<br>
<b>Cc:</b> 1008668@bugs.debian.org<br>
<b>Subject:</b> Re: bug #1008668: tomcat9: logrotated is not able to truncate catalina.out</font>
<div> </div>
</div>
<div>
<meta content="text/html; charset=UTF-8">
<style type="text/css" style="">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div dir="ltr">
<div id="x_divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:#000000; font-family:Calibri,Helvetica,sans-serif">
<p>Hi Markus,</p>
<p><br>
</p>
<p>You are quite right. The root cause of the issue is Ubuntu dropping privileges of rsyslogd to `syslog` user. This change was done way back in ~2009 in Ubuntu package.</p>
<p><br>
</p>
<p><a href="https://bugs.launchpad.net/ubuntu/+source/rsyslog/+bug/388608" class="x_OWAAutoLink" id="LPlnk732743">https://bugs.launchpad.net/ubuntu/+source/rsyslog/+bug/388608</a> (which does not explain the benefits very clearly, but my assumption is an attempt
at improving security).<br>
</p>
<p></p>
<div><br>
</div>
<p></p>
<p>As you put it adequately. There are other Debian packages also use rsyslogd. This change in Ubuntu's rsyslog configuration should be effecting those also. I had a quick look using apt-file for packages which put configurations to
<span>/etc/rsyslog.d. The ones I checked does not seem to specify a certain user/group in rsyslog config</span>. This cause files to be owned as root:adm and 640 permission in Debian which is the default according to `<span>/etc/rsyslog.conf</span>` and in
Ubuntu they would be owned by Ubuntu's default settings automatically as well.<br>
<br>
</p>
<p>Could it be more acceptable if the '<span>fileOwner="tomcat"</span>' setting was simply removed from rsyslog config of tomcat9? In addition, 'create 640 tomcat adm' and ' su tomcat adm' settings could be removed from logrotate config of tomcat9?</p>
<p><br>
</p>
<p>One advantage for Debian is that `tomcat` itself can't read the log files anymore. This could be considered more secure. But not that it would help much, as tomcat9 package triple-logs everything. First through syslog to catalina.out, then directly to
<span>catalina.YYYY-MM-DD.log in a different format</span>. Of course nowadays a third time through journald. :)</p>
<p><br>
</p>
<p>Thanks,<br>
Evren<br>
</p>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Markus Koschany <apo@debian.org><br>
<b>Sent:</b> Thursday, April 14, 2022 5:31:49 PM<br>
<b>To:</b> Utkarsh Gupta; Evren Yurtesen<br>
<b>Cc:</b> 1008668@bugs.debian.org<br>
<b>Subject:</b> Re: bug #1008668: tomcat9: logrotated is not able to truncate catalina.out</font>
<div> </div>
</div>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">Am Donnerstag, dem 14.04.2022 um 16:23 +0530 schrieb Utkarsh Gupta:<br>
> Hi Emmanuel,<br>
> <br>
> We have bug #1008668 that's causing problems on the Ubuntu side and is<br>
> also reproducible via the Debian package (essentially, it's the same<br>
> in both places).<br>
<br>
Hi Utkarsh,<br>
<br>
I have been trying to reproduce this problem but on an up-to-date Debian system<br>
running tomcat9 version 9.0.58-1 I cannot reproduce it. catalina.out is<br>
truncated when I run <br>
<br>
logrotate -f /etc/logrotate.d/tomcat9<br>
<br>
The logrotate file changes the permissions to "su tomcat adm" which is<br>
sufficient to operate on tomcat9 log files. I'm not familiar with the Ubuntu<br>
differences when it comes to logrotate and rsyslogd but I suppose that is the<br>
underlying issue here. It would be strange if we had to change the permissions<br>
to syslog adm because other Debian packages also own log files with their<br>
specific users and then does not cause any problems too.<br>
<br>
Thus said I am not against fixing this for Ubuntu but the current approach<br>
seems wrong to me.<br>
<br>
Regards,<br>
<br>
Markus<br>
<br>
<br>
</div>
</span></font></div>
</div>
</body>
</html>