Re: httpd(8) log files are world and daemon-readable

Hi Piotr,

I disagree with your assessment that they probably shouldn’t be world readable.  You will break a lot of unprivileged programs expecting access to www logs, such as log analysis and security monitors.

On the flip side, someone wanting world readable files can just create them before running httpd for the first time and also modifying newsyslog.conf.  The same can be said right now for someone who wants tighter permissions.

I’m not a developer, but I do use httpd a lot.  Take my advice with a grain of salt.

Thanks,
Brian

> On Aug 26, 2026, at 3:11 PM, Piotr Durlej <[email protected]> wrote:
> 
> Hello,
> 
> currently the httpd(8) log files are world and daemon-readable and probably they shouldn't.
> 
> Maybe the following patch will do the trick:
> 
> ---
> etc/newsyslog.conf      | 4 ++--
> usr.sbin/httpd/logger.c | 2 +-
> 2 files changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/etc/newsyslog.conf b/etc/newsyslog.conf
> index e496ab998bc..b68748a41a6 100644
> --- a/etc/newsyslog.conf
> +++ b/etc/newsyslog.conf
> @@ -13,5 +13,5 @@
> /var/log/wtmp                644  7     *    $M1D4 B ""
> /var/log/xferlog            640  7     250  *     Z
> /var/log/pflog                600  3     250  *     ZB "pkill -HUP -u root -U root -t - -x pflogd"
> -/var/www/logs/access.log        644  4     *    $W0   Z "pkill -USR1 -u root -U root -x httpd"
> -/var/www/logs/error.log            644  7     250  *     Z "pkill -USR1 -u root -U root -x httpd"
> +/var/www/logs/access.log        600  4     *    $W0   Z "pkill -USR1 -u root -U root -x httpd"
> +/var/www/logs/error.log            600  7     250  *     Z "pkill -USR1 -u root -U root -x httpd"
> diff --git a/usr.sbin/httpd/logger.c b/usr.sbin/httpd/logger.c
> index c2eae70f4fd..b9c912b186d 100644
> --- a/usr.sbin/httpd/logger.c
> +++ b/usr.sbin/httpd/logger.c
> @@ -183,7 +183,7 @@ logger_open_priv(struct imsg *imsg)
>        return (-1);
>    }
> 
> -    if ((fd = open(path, O_WRONLY|O_APPEND|O_CREAT, 0644)) == -1) {
> +    if ((fd = open(path, O_WRONLY|O_APPEND|O_CREAT, 0600)) == -1) {
>        log_warn("failed to open %s", path);
>        return (-1);
>    }
> --
> 2.53.0
> 
> Kind regards,
> Piotr Durlej
>