From fb38a7beb8157a0674559441de957359d16d85be Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Wed, 27 Nov 2019 19:15:11 +0100 Subject: [PATCH] tmpfiles: apply ACLs to top-level journal directory in /run, too We already apply them to the directory in /var. Let's do the same in /run too. That's because due to the log namespace logic we nowadays can gain additional subdirs there during regular operation. --- tmpfiles.d/systemd.conf.m4 | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tmpfiles.d/systemd.conf.m4 b/tmpfiles.d/systemd.conf.m4 index b251c4bcde..11d87d275b 100644 --- a/tmpfiles.d/systemd.conf.m4 +++ b/tmpfiles.d/systemd.conf.m4 @@ -32,13 +32,16 @@ Z /run/log/journal/%m ~2750 root systemd-journal - - m4_ifdef(`HAVE_ACL',`m4_dnl m4_ifdef(`ENABLE_ADM_GROUP',`m4_dnl m4_ifdef(`ENABLE_WHEEL_GROUP',`` +a+ /run/log/journal - - - - d:group::r-x,d:group:adm:r-x,d:group:wheel:r-x,group::r-x,group:adm:r-x,group:wheel:r-x a+ /run/log/journal/%m - - - - d:group:adm:r-x,d:group:wheel:r-x,group:adm:r-x,group:wheel:r-x a+ /run/log/journal/%m/*.journal* - - - - group:adm:r--,group:wheel:r-- '',`` +a+ /run/log/journal - - - - d:group::r-x,d:group:adm:r-x,group::r-x,group:adm:r-x a+ /run/log/journal/%m - - - - d:group:adm:r-x,group:adm:r-x a+ /run/log/journal/%m/*.journal* - - - - group:adm:r-- '')',`m4_dnl m4_ifdef(`ENABLE_WHEEL_GROUP',`` +a+ /run/log/journal - - - - d:group::r-x,d:group:wheel:r-x,group::r-x,group:wheel:r-x a+ /run/log/journal/%m - - - - d:group:wheel:r-x,group:wheel:r-x a+ /run/log/journal/%m/*.journal* - - - - group:wheel:r-- '')')')m4_dnl