Bug#1141328: jetty9: LogsDirectory= changes /var/log/jetty9 group from adm to jetty

[ofrytest at gmail.com]

Package: jetty9

Version: 9.4.58-2

Severity: normal

 

Subject: jetty9: LogsDirectory= changes /var/log/jetty9 group from adm to
jetty

 

The package currently uses two conflicting mechanisms to manage the
ownership of the log directory.

 

The tmpfiles configuration installs the directory as:

 

```

d /var/log/jetty9 0750 jetty adm

Z /var/log/jetty9 - jetty adm

```

 

which clearly specifies that the directory group should be "adm".

 

However, the systemd service contains:

 

```

User=jetty

Group=jetty

LogsDirectory=jetty9

```

 

According to the systemd.exec(5) documentation, LogsDirectory= ensures that
the innermost directory is owned by the User= and Group= configured for the
service. As a result, when the service starts, systemd changes the ownership
of:

 

```

/var/log/jetty9

```

 

from:

 

```

jetty:adm

```

 

to:

 

```

jetty:jetty

```

 

The package previously managed directory ownership in postinst, but starting
with version 9.4.58-2 this logic has been migrated to systemd-tmpfiles while
LogsDirectory= has been kept unchanged.

 

The packaging therefore contains two contradictory ownership definitions for
the same directory:

 

* debian/jetty9.tmpfiles expects:

  jetty:adm

 

* debian/jetty9.service (via LogsDirectory=) enforces:

  jetty:jetty

 

I could not find any packaging logic that restores the "adm" group after the
service starts:

 

* postinst no longer changes ownership of /var/log/jetty9;

* no ExecStartPre= hook performs a corrective chown;

* no ACLs are installed;

* no other packaging scripts modify the directory ownership.

 

Therefore, unless systemd has changed the semantics of LogsDirectory=,
starting the service will overwrite the ownership established by tmpfiles.d.

 

I believe the package should use only one ownership mechanism, or both
mechanisms should agree on the expected ownership.

 

Possible fixes include either:

 

* changing the tmpfiles entry to use group "jetty" if that is the intended
ownership; or

* avoiding LogsDirectory= if the intended group is "adm".

 

The current packaging is internally inconsistent and causes the configured
ownership of /var/log/jetty9 to change depending on whether tmpfiles or
systemd processed the directory most recently.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-java-maintainers/attachments/20260703/97090517/attachment-0001.htm>