From: Brian Brombacher Subject: Re: httpd(8) log files are world and daemon-readable To: Piotr Durlej Cc: tech@openbsd.org Date: Wed, 26 Aug 2026 16:21:43 -0400 Hi Piotr, I disagree with your assessment that they probably shouldn’t be world readable. You will break a lot of unprivileged programs expecting access to www logs, such as log analysis and security monitors. On the flip side, someone wanting world readable files can just create them before running httpd for the first time and also modifying newsyslog.conf. The same can be said right now for someone who wants tighter permissions. I’m not a developer, but I do use httpd a lot. Take my advice with a grain of salt. Thanks, Brian > On Aug 26, 2026, at 3:11 PM, Piotr Durlej wrote: > > Hello, > > currently the httpd(8) log files are world and daemon-readable and probably they shouldn't. > > Maybe the following patch will do the trick: > > --- > etc/newsyslog.conf | 4 ++-- > usr.sbin/httpd/logger.c | 2 +- > 2 files changed, 3 insertions(+), 3 deletions(-) > > diff --git a/etc/newsyslog.conf b/etc/newsyslog.conf > index e496ab998bc..b68748a41a6 100644 > --- a/etc/newsyslog.conf > +++ b/etc/newsyslog.conf > @@ -13,5 +13,5 @@ > /var/log/wtmp 644 7 * $M1D4 B "" > /var/log/xferlog 640 7 250 * Z > /var/log/pflog 600 3 250 * ZB "pkill -HUP -u root -U root -t - -x pflogd" > -/var/www/logs/access.log 644 4 * $W0 Z "pkill -USR1 -u root -U root -x httpd" > -/var/www/logs/error.log 644 7 250 * Z "pkill -USR1 -u root -U root -x httpd" > +/var/www/logs/access.log 600 4 * $W0 Z "pkill -USR1 -u root -U root -x httpd" > +/var/www/logs/error.log 600 7 250 * Z "pkill -USR1 -u root -U root -x httpd" > diff --git a/usr.sbin/httpd/logger.c b/usr.sbin/httpd/logger.c > index c2eae70f4fd..b9c912b186d 100644 > --- a/usr.sbin/httpd/logger.c > +++ b/usr.sbin/httpd/logger.c > @@ -183,7 +183,7 @@ logger_open_priv(struct imsg *imsg) > return (-1); > } > > - if ((fd = open(path, O_WRONLY|O_APPEND|O_CREAT, 0644)) == -1) { > + if ((fd = open(path, O_WRONLY|O_APPEND|O_CREAT, 0600)) == -1) { > log_warn("failed to open %s", path); > return (-1); > } > -- > 2.53.0 > > Kind regards, > Piotr Durlej >