Bug#1141328: jetty9: LogsDirectory= changes /var/log/jetty9 group from adm to jetty

[ofrytest at gmail.com]

I found one more packaging issue that becomes visible once the log directory
permissions are corrected.

After changing `/var/log/jetty9` to the permissions required for rsyslog
(`0770 jetty:adm`), the package's current logrotate configuration no longer
works.

Running:

```
sudo logrotate -f /etc/logrotate.d/jetty9
```

fails with:

```
error: skipping "/var/log/jetty9/jetty-console.log" because parent directory
has insecure permissions (It's world writable or writable by group which is
not "root") Set "su" directive in config file to tell logrotate which
user/group should be used for rotation.
```

This is expected behaviour of logrotate. When the parent directory is
writable by a non-root group, logrotate refuses to operate unless an
explicit `su` directive is configured.

After adding:

```
su jetty adm
```

to the logrotate configuration, rotation succeeds normally.

Combined with the previously reported issue regarding:

```
create 640 jetty adm
```

(which should be `create 660 jetty adm` so that rsyslog can continue writing
after rotation), the package's logrotate configuration also requires the
appropriate `su` directive.

In other words, if the package is fixed by making `/var/log/jetty9` writable
by the `adm` group (which is necessary for rsyslog), the logrotate
configuration must be updated accordingly as well. Otherwise log rotation
will fail with the "parent directory has insecure permissions" error.

On Sat, 4 Jul 2026 20:32:44 +0300 <ofrytest at gmail.com> wrote: 
> I have found an additional packaging issue related to the permissions used

> for the Jetty log directory and log rotation. 
> 
> ### 1. `/var/log/jetty9` should be owned by `jetty:adm` with mode `0770` 
> 
> Even if the ownership problem caused by `LogsDirectory=` is addressed, the

> directory permissions themselves are still insufficient for the intended 
> logging design. 
> 
> `rsyslog` runs as: 
> 
> ``` 
> User: syslog 
> Group: syslog 
> Supplementary groups: adm 
> ``` 
> 
> Therefore it does not need to become the owner of `/var/log/jetty9`, but
it 
> **does** require write permission through the `adm` group in order to
create 
> new log files. 
> 
> With the current packaging, the directory eventually becomes owned by 
> `jetty:jetty` with mode `0750`, which completely prevents `rsyslog` from 
> creating `jetty-console.log`. 
> 
> Even if the ownership is corrected back to `jetty:adm`, mode `0750` still 
> leaves the group without write permission. 
> 
> For the logging configuration installed by the package to work correctly, 
> the directory needs to be writable by members of the `adm` group. In 
> practice this means ownership `jetty:adm` together with mode `0770`. 
> 
> ### 2. The logrotate configuration recreates the file with insufficient 
> permissions 
> 
> There is another independent issue in the package's logrotate
configuration. 
> 
> The installed configuration currently contains: 
> 
> ``` 
> create 640 jetty adm 
> ``` 
> 
> After every rotation, logrotate recreates `jetty-console.log` as: 
> 
> ``` 
> -rw-r----- 
> jetty:adm 
> ``` 
> 
> At this point `rsyslog` is no longer the file owner, and accesses the file

> through its supplementary `adm` group membership. 
> 
> However, mode `0640` grants the group only read permission, so `rsyslog`
can 
> no longer append new log messages after the file has been recreated. 
> 
> Changing the directory permissions alone is therefore not sufficient to
fix 
> the problem. 
> 
> The recreated log file also needs to remain writable by the `adm` group.