Re: httpd(8) log files are world and daemon-readable

If they are trusted users, why are you worried about them accessing your web logs?  Obviously they are authorized to be logged into your web server, so they must be authorized to view web logs.  I assumed you had untrusted local users since you were so concerned about file permissions.

GDPR requires “State of the Art” security and isolation techniques, not “whatever my OS provides.”  For over the past decade, hypervisor-enforced isolation has been the industry standard for separating untrusted workloads.

If you did have untrusted local users logging into your web server, that would absolutely fall under “willful and negligent” violation the moment you have a security incident or data breach and someone comes to investigate.  There have been huge fines given out for this exact design.  The entire legacy web hosting industry is in legal hot water right now until they fully containerize/virtualize their individual tenants.

Maybe a better solution is group-readable web logs for a dedicated group, like _logread or something.  That way the default system caters to you and to everyone else who wants to run log analysis programs as non-root users.

Making users figure out what knobs to turn in order to make their own group-readable logs will just result in more users running fragile log analysis scripts as root instead.

-Brian

> On Aug 28, 2026, at 8:15 AM, Piotr Durlej <[email protected]> wrote:
> 
> On Thu, Aug 27, 2026 at 11:20:42PM -0400, Brian Brombacher wrote:
>> Try convincing an inspector from your national DPA that your setup is in compliance and doesn’t violate Article 32 and 25.  The design is fundamentally flawed in the eyes of the GDPR.  It extends into “willful and negligent” violation of the GDPR.
>> 
>> You can never have untrusted local users on a production system that is required by law to be secure and private.  There is no way you can spin this.
> 
> Your conclusion is based on an incorrect assumption that the production environment allows uncontrolled access by local, untrusted users. It does not.
> 
> GDPR compliance under Articles 25 and 32 is not measured by hypothetical worst-case scenarios, but by the presence of appropriate technical and organizational measures proportional to the actual risks. Those measures are in place, documented, and auditable.
> 
> An inspector evaluates the implemented controls, not speculative interpretations detached from the real architecture. Your claim of a "fundamentally flawed" or "willful and negligent" violation is therefore unfounded.
> 
> Kind regards,
> Piotr Durlej
>