-
Notifications
You must be signed in to change notification settings - Fork 597
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
default log permissions are too permissive #82
Comments
100% agree |
Just FYI, you can get around this in the current system by creating the original file yourself with the permissions you want, and then lumberjack will respect those and copy them to any new file it creates. |
@natefinch right, it's not a blocking issue thanks to that. I think the new defaults basically close this issue |
This was referenced May 30, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
The default permissions for the logs are set to 644, which is very permissive, as anyone can read the log files; which can be a security issue depending on the context.
I propose having a default of 600, which allows the application to read and write its own logs; and leaving root/admin users still with the ability to read the logs (which would normally need to see the logs).
The text was updated successfully, but these errors were encountered: