Skip to content

Changed default file modes from 0o644 to 0o600 for better security#1141

Merged
lamweili merged 1 commit intomasterfrom
improve-security
Jan 16, 2022
Merged

Changed default file modes from 0o644 to 0o600 for better security#1141
lamweili merged 1 commit intomasterfrom
improve-security

Conversation

@lamweili
Copy link
Contributor

No description provided.

@lamweili lamweili added this to the 6.4.0 milestone Jan 16, 2022
@thernstig
Copy link

@peteriman this is a breaking change, as we just noticed this. it breaks things in Kubernetes e.g. when using a sidecar to read logs. (Even though it is configurable the defaults broke). So it probably should have been reserved for 7.X.

@lamweili
Copy link
Contributor Author

lamweili commented Mar 23, 2022

You are right. My mistake.

In hindsight, probably should have used 7.x.x instead to not break things for existing users who uses the default file permissions.

I have updated the changelog (7010a7d) to have a more indicative warning now we are unable to go back in time.


For whoever might be reading this, to workaround the breaking change:

  1. Either run the other applications, that needs to read the log, using the same user account (due to 0o600), or
  2. Manually specify the permission (such as 0o644) to be used through the mode options as listed in the fileAppender docs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

log file generated has permission issue in ^6.4.0

2 participants