Re: httpd(8) log files are world and daemon-readable

On Fri, Aug 28, 2026 at 12:49:11PM -0400, Brian Brombacher wrote:
> Piotr,
> 
> You are the one who explicitly brought up GDPR compliance to justify this patch.  You don’t get to invoke international privacy regulations as a hammer and then claim the discussion isn’t about that when your threat model is dismantled.
> 
> Your definition of “State of the Art” under data protection frameworks is legally incorrect.  “State of the Art” refers strictly to the current baseline of global technological capability, not “whatever isolation mechanism is currently popular.”  While the GDPR absolutely allows low-risk operations to use proportional measures like standard file permissions, it does not redefine technical baselines.
> 
> The wheel group is absolutely not a better choice for log analysis.  That group is dedicated solely for administrators.  Giving any local user wheel access is the same as handing them the keys to the kingdom.
> 
> Nginx and Apache httpd both create log files with permission 644 and in the case of Apache httpd, this can be configured to 640.  These industry standard daemons expect the administrator to use umasks to further tighten permissions.  Most distros of Linux lock permissions to 640 and use group adm or another dedicated group.  No major distro or OS sets the permissions to root-only.
> 
> As a system default, root-only permissions is a bad choice for web logs and is considered an anti-pattern.
> 
> -Brian

Brian,

Thanks for the clarification. At this point it's clear that we are approaching the topic from different assumptions and focusing on different aspects of system design.

My concern was limited to default file permissions and least‑privilege principles on multi‑user Unix systems. Your points relate to broader questions about hosting models, isolation strategies and industry practices, which are outside the scope of what I was addressing.

Different environments make different choices, and administrators adjust defaults according to their needs. My suggestion concerned only the baseline configuration and reducing unnecessary exposure of log data. Beyond that, each deployment applies its own policies.

I think we've both explained our positions sufficiently, so I'll leave it here.

Kind regards,
Piotr Durlej