Set permissions for rollover file

[StudentGu]

Warning!
It is highly recommended to discuss feature requests in the mailing lists first.

[A clear and concise description of the feature requested.]
When a log rollover, I can not update the permissions, it inherited the permissions of the original file

[ppkarwasz]

@StudentGu,

When a log rollover, I can not update the permissions, it inherited the permissions of the original file

Can you give us the:

• configuration of your rolling file appender,
• the OS you are using,
• the user that is running the Java application (is it a privileged user, is it the owner of the log file, etc.)?

[StudentGu]

@StudentGu,

When a log rollover, I can not update the permissions, it inherited the permissions of the original file

Can you give us the:

• configuration of your rolling file appender,
• the OS you are using,
• the user that is running the Java application (is it a privileged user, is it the owner of the log file, etc.)?

@ppkarwasz

Yes, please see the answer below:

• configuration

  <RollingFile name="task_sync" fileName="${sys:catalina.base}/apphome/log/task.log">
    <PatternLayout>
  	<Pattern>TASK INFORMATION | %mm | THREAD=&quot;%t&quot; %n</Pattern>
    </PatternLayout>
  </RollingFile>
  <Async name="vsc_task_run_file">
  	<AppenderRef ref="task_sync"/>
  	<NoteCategoryFilter category="SCHEDULE"/>
  </Async>

• OS

  Linux kwephis12504946 4.12.14-120-default #1 SMP Thu Nov 7 16:39:09 UTC 2019 (fd9dc36) x86_64 x86_64 x86_64 GNU/Linux

• the current file is task.log with the permissions "-rw-r-----",

  and when task.log is rolled to task_xxxx.log, it permissions still is "-rw-r-----", which i want it permissions is "-r--r-----"

So, how can i configure the rolled file permissions to be different from the current file

If it is not currently supported, can I add this feature to the project?

[ppkarwasz]

@StudentGu,

[I am surprised your RollingFile configuration works at all, since it lacks the required configuration parameters (filePattern and a nested Triggering Policy). Double check if this is the actual configuration file you are using.]

You can modify the permission of archived log file, by adding a PosixViewAttribute action to the rollover strategy:

<RollingFile name="task_sync"
             fileName="${sys:catalina.base}/apphome/log/task.log"
             filePattern="${sys:catalina.base}/apphome/log/task.%{yyyy-MM-dd}.log">
  <PatternLayout pattern="TASK INFORMATION | %m | THREAD=&quot;%t&quot; %n"/>
  <DefaultRolloverStrategy>
    <PosixViewAttribute basePath="${sys:catalina.base}/apphome/log"
                        filePermissions="-r--r----">
      <IfFileName glob="task.*.log"/>
    </PosixViewAttribute>
  </DefaultRolloverStrategy>
  <TimeBasedTriggeringPolicy/>
</RollingFile>

[StudentGu]

@StudentGu,

[I am surprised your RollingFile configuration works at all, since it lacks the required configuration parameters (filePattern and a nested Triggering Policy). Double check if this is the actual configuration file you are using.]

You can modify the permission of archived log file, by adding a PosixViewAttribute action to the rollover strategy:

<RollingFile name="task_sync"
             fileName="${sys:catalina.base}/apphome/log/task.log"
             filePattern="${sys:catalina.base}/apphome/log/task.%{yyyy-MM-dd}.log">
  <PatternLayout pattern="TASK INFORMATION | %m | THREAD=&quot;%t&quot; %n"/>
  <DefaultRolloverStrategy>
    <PosixViewAttribute basePath="${sys:catalina.base}/apphome/log"
                        filePermissions="-r--r----">
      <IfFileName glob="task.*.log"/>
    </PosixViewAttribute>
  </DefaultRolloverStrategy>
  <TimeBasedTriggeringPolicy/>
</RollingFile>

@ppkarwasz

It is too complicated, and because the 'PosixViewAttributeAction' action is asynchronous, there may be a temporary permission error.
So i want to configure simply just like this, and implement the function in the 'FileRenameAction'.

<RollingFile name="task_sync"
             fileName="${sys:catalina.base}/apphome/log/task.log"
             filePattern="${sys:catalina.base}/apphome/log/task.%{yyyy-MM-dd}.log"
             filePermissions="-rx-r----"
             rolledFilePermissions="-r--r----">
  <PatternLayout pattern="TASK INFORMATION | %m | THREAD=&quot;%t&quot; %n"/>
  <TimeBasedTriggeringPolicy/>
</RollingFile>

Can I do that?

[ppkarwasz]

Log4j Core is highly extensible. Since RollingFile does not have a rolledFilePermissions property (see plugin reference for the complete list), you can create your own plugin that does.

You don't even need to implement any append logic, just create a builder that creates a standard RollingFileAppender:

@Plugin(name = "MyRollingFile", category = CATEGORY)
public abstract class MyRollingFileAppender implements Appender {

    @PluginBuilderFactory
    public static Builder newBuilder() {
        return new Builder();
    }

    public static final class Builder extends RollingFileAppender.Builder<Builder> {

        @PluginBuilderAttribute
        private String rollingFilePermissions;

        @Override
        public RollingFileAppender build() {
            final Action posixViewAttribute = PosixViewAttributeAction.newBuilder()
                    .withFilePermissionsString(rollingFilePermissions)
                    // Remaining parameters go here
                    .build();
            final RolloverStrategy strategy = DefaultRolloverStrategy.newBuilder()
                    .withCustomActions(new Action[] {posixViewAttribute})
                    // Remaining parameters go here
                    .build();
            return RollingFileAppender.newBuilder()
                    .withStrategy(strategy)
                    // Remaining parameters go here
                    .build();
        }
    }
}

See Plugins on more details on how to develop your own plugins.

[StudentGu]

@ppkarwasz

Mybay it is a common feature in some companies that need to consider file security.
So I suggest adding this feature to log4j's default policy.