search

natefinch / lumberjack

lumberjack is a log rolling package for Go
MIT License
4.79k stars 591 forks source link

default log permissions are too permissive #82

Closed JAORMX closed 5 years ago

JAORMX commented 5 years ago

The default permissions for the logs are set to 644, which is very permissive, as anyone can read the log files; which can be a security issue depending on the context.

I propose having a default of 600, which allows the application to read and write its own logs; and leaving root/admin users still with the ability to read the logs (which would normally need to see the logs).

natefinch commented 5 years ago

100% agree

natefinch commented 5 years ago

Just FYI, you can get around this in the current system by creating the original file yourself with the permissions you want, and then lumberjack will respect those and copy them to any new file it creates.

JAORMX commented 5 years ago

@natefinch right, it's not a blocking issue thanks to that.

I think the new defaults basically close this issue