Re: httpd(8) log files are world and daemon-readable

If you have multiple unprivileged, and more importantly, UNTRUSTED users logging into your production EU web server handling GDPR-eligible traffic, you have a lot more to worry about than a permission bit on a log file.

What stops your malicious local users from running netstat -an in a tight loop and recording every connection timestamp and IP address?  There goes your “GDPR Compliance” out the window.

Your threat model is fundamentally flawed.  Don’t mix candied apples with anchovies and expect something edible.

-Brian

> On Aug 27, 2026, at 8:53 AM, Piotr Durlej <[email protected]> wrote:
> 
> On Thu, Aug 27, 2026 at 07:19:52PM +1000, jslee wrote:
>>> On Thu, 27 Aug 2026, at 05:09, Piotr Durlej wrote:
>>> currently the httpd(8) log files are world and daemon-readable and
>>> probably they shouldn't.
>> 
>> What specific risk are you trying to mitigate here?
>> 
>> If it’s “there might be sensitive stuff in request URLs”, I suggest to you that you are focusing on the wrong problem here. Such things do not belong in URLs.
>> 
>> If it’s not that, perhaps you could explain your reasons?
>> 
>> John
>> 
> 
> On multi-user systems, world-readable HTTP logs expose IPs, request URIs and timestamps to all local users. In the EU these are usually considered personal data under GDPR, and the current defaults do not seem to follow the privacy by default principle. From a secure by default and least privilege perspective, it seems safer to restrict access by default and let administrators explicitly grant access to users or tools that need it.
> 
> HTTP logs may also contain unsolicited or abusive content originating from external clients. This is not just a theoretical concern. On one of my web servers, I am currently dealing with hostile and intimidating messages being repeatedly inserted into access.log via external requests, and world-readable permissions make such content visible to all local users.
> 
> Kind regards,
> Piotr Durlej
>