Re: httpd(8) log files are world and daemon-readable

On Thu, Aug 27, 2026 at 07:19:52PM +1000, jslee wrote:
> On Thu, 27 Aug 2026, at 05:09, Piotr Durlej wrote:
> > currently the httpd(8) log files are world and daemon-readable and 
> > probably they shouldn't.
> 
> What specific risk are you trying to mitigate here?
> 
> If it’s “there might be sensitive stuff in request URLs”, I suggest to you that you are focusing on the wrong problem here. Such things do not belong in URLs.
> 
> If it’s not that, perhaps you could explain your reasons?
> 
> John
> 

On multi-user systems, world-readable HTTP logs expose IPs, request URIs and timestamps to all local users. In the EU these are usually considered personal data under GDPR, and the current defaults do not seem to follow the privacy by default principle. From a secure by default and least privilege perspective, it seems safer to restrict access by default and let administrators explicitly grant access to users or tools that need it.

HTTP logs may also contain unsolicited or abusive content originating from external clients. This is not just a theoretical concern. On one of my web servers, I am currently dealing with hostile and intimidating messages being repeatedly inserted into access.log via external requests, and world-readable permissions make such content visible to all local users.

Kind regards,
Piotr Durlej