Changes between Initial Version and Version 1 of Ticket #376, comment 4


Ignore:
Timestamp:
11/11/16 02:14:41 (7 years ago)
Author:
Jérôme Poulin

Legend:

Unmodified
Added
Removed
Modified

  • Ticket #376, comment 4

    initial v1  
    1 To make matter worse, the log is always opened using O_CREAT, disallowing the use of AppArmor to restrict the log file opening to append only.
     1To make matter worse, the log is always opened using O_CREAT, disallowing the use of !AppArmor to restrict the log file opening to append only.
    22
    33The workaround we're using is:
    4 * Make a AppArmor profile which removes dac_override and chown capabilities from Nginx.
     4* Make a !AppArmor profile which removes dac_override and chown capabilities from Nginx.
    55* Set-up logrotate to create files as root:adm/0640.
    66* Set-up logrotate to issue a SIGHUP instead of SIGUSR1.