Linux中目录的访问权限

Question

I have a programm which creates log files in web-server directory (/var/www/log). Every day it generates one new log file. I've set access permissions for this directory to 777

chmod 777 -R /var/www/log

But when system generates log file for new day, it doesn't have access permissions 777. I have to do it manually again. How can I correctly set permissions for directory? All files in this directory must have 777 automatically.

Answer 1

1. It is a very bad idea to have files executable which don't need to be: it is a possible security risk, and not a small one. in your case, some files owned by root would be writable to the public. It is quite easy to modify them as to run as root (yes, you can make ANY file behave as a program under Linux)for everybody who has write permissions on that file. As twalberg pointed out: this is a Really Bad Idea™
2. Do not write log files directly. It makes the life of the system administrator unnecessarily hard. Use syslog instead. Every programming language has the option to log to syslog. Reason behind that: it could very well be and often happens that when companies reach a certain size, they use a centralized syslog server. When every package behaves nicely, all which has to be done is to change one configuration file and all the log entries are send to that dedicated syslog server. Or the admin might want to change the location a log file is written to, for example from /var/www/log to /var/log/www. One line in a syslogd.conf, but unpredictable amount of lines when log files are written directly. Writing log files directly may be a nice fall back, but doing so by default is bad practice.
3. In case you run a software not written by you but not native to your linux distribution, you could start it as root and make it drop it's privileges to a dedicated user for this software using the runuser or sudo commands. This dedicated user could have write access to the log files. This still is a hack. A service should be able to run as user nobody.

In general, I do not understand why all users must have access to all log files. Please elaborate that.

For completeness:

What most likely happens is that logrotate kicks in. It is a tool compresses old and deletes outdated log files and creates new ones based on what is configured in /etc/logrotate.conf and files included there. Otherwise your server would run out of space after a while. You can either change the configuration of logrotate or

DO NOT DO THE FOLLOWING

You could add a chmod 0777 -R /var/www/log either to the crontab root or the various system crontabs.