From: Piotr Durlej Subject: httpd(8) log files are world and daemon-readable To: tech@openbsd.org Date: Wed, 26 Aug 2026 21:09:42 +0200 Hello, currently the httpd(8) log files are world and daemon-readable and probably they shouldn't. Maybe the following patch will do the trick: --- etc/newsyslog.conf | 4 ++-- usr.sbin/httpd/logger.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/etc/newsyslog.conf b/etc/newsyslog.conf index e496ab998bc..b68748a41a6 100644 --- a/etc/newsyslog.conf +++ b/etc/newsyslog.conf @@ -13,5 +13,5 @@ /var/log/wtmp 644 7 * $M1D4 B "" /var/log/xferlog 640 7 250 * Z /var/log/pflog 600 3 250 * ZB "pkill -HUP -u root -U root -t - -x pflogd" -/var/www/logs/access.log 644 4 * $W0 Z "pkill -USR1 -u root -U root -x httpd" -/var/www/logs/error.log 644 7 250 * Z "pkill -USR1 -u root -U root -x httpd" +/var/www/logs/access.log 600 4 * $W0 Z "pkill -USR1 -u root -U root -x httpd" +/var/www/logs/error.log 600 7 250 * Z "pkill -USR1 -u root -U root -x httpd" diff --git a/usr.sbin/httpd/logger.c b/usr.sbin/httpd/logger.c index c2eae70f4fd..b9c912b186d 100644 --- a/usr.sbin/httpd/logger.c +++ b/usr.sbin/httpd/logger.c @@ -183,7 +183,7 @@ logger_open_priv(struct imsg *imsg) return (-1); } - if ((fd = open(path, O_WRONLY|O_APPEND|O_CREAT, 0644)) == -1) { + if ((fd = open(path, O_WRONLY|O_APPEND|O_CREAT, 0600)) == -1) { log_warn("failed to open %s", path); return (-1); } -- 2.53.0 Kind regards, Piotr Durlej