I'm fed up of having to be root to read log files when troubleshooting. I'd like to add a sudo line that gives me read-only rights to /var/log/ - is this possible? I've not found any example of limted rights like that - and I don't want to allow write access to anyone other than root. Anne

On Monday 31 Oct 2011 10:40:12 Patrick Boutilier wrote: > On 10/31/2011 07:33 AM, Anne Wilson wrote: >> I'm fed up of having to be root to read log files when troubleshooting. >> I'd like to add a sudo line that gives me read-only rights to /var/log/ - >> is this possible? I've not found any example of limted rights like that >> - and I don't want to allow write access to anyone other than root. >> >> Anne > > Not really a KDE issue, but facl should work. $user will be your userid. > > setfacl -R -m u:$user:r /var/log/ > > > > > This one will give you access to newly created logs files without having > to run the above again. > > > setfacl -d -R -m u:$user:r /var/log/ > Thanks. Unfortunately it doesn't seem to work - kwrite still shows an empty file even though I can see the size of it indicating that it is quite big. Anne

On Monday 31 Oct 2011 12:21:10 Patrick Boutilier wrote: > On 10/31/2011 09:16 AM, Anne Wilson wrote: >> On Monday 31 Oct 2011 10:40:12 Patrick Boutilier wrote: >>> On 10/31/2011 07:33 AM, Anne Wilson wrote: >>>> I'm fed up of having to be root to read log files when troubleshooting. >>>> I'd like to add a sudo line that gives me read-only rights to /var/log/ >>>> - is this possible? I've not found any example of limted rights like >>>> that - and I don't want to allow write access to anyone other than >>>> root. >>>> >>>> Anne >>> >>> Not really a KDE issue, but facl should work. $user will be your userid. >>> >>> setfacl -R -m u:$user:r /var/log/ >>> >>> >>> >>> >>> This one will give you access to newly created logs files without having >>> to run the above again. >>> >>> >>> setfacl -d -R -m u:$user:r /var/log/ >> >> Thanks. Unfortunately it doesn't seem to work - kwrite still shows an >> empty file even though I can see the size of it indicating that it is >> quite big. >> >> Anne > > Which file in /var/log/ ? > > What does getfacl /var/log/<file> show? > # file: var/log/dmesg # owner: root # group: root user::rw- user:anne:r-- group::r-- mask::r-- other::r-- > > Does this work from a prompt? > > tail /var/log/<file> > tail /var/log/dmesg -bash: /var/log/dmesg: Permission denied Anne

On Monday 31 Oct 2011 12:33:14 Patrick Boutilier wrote: > On 10/31/2011 09:27 AM, Anne Wilson wrote: >> On Monday 31 Oct 2011 12:21:10 Patrick Boutilier wrote: >>> On 10/31/2011 09:16 AM, Anne Wilson wrote: >>>> On Monday 31 Oct 2011 10:40:12 Patrick Boutilier wrote: >>>>> On 10/31/2011 07:33 AM, Anne Wilson wrote: >>>>>> I'm fed up of having to be root to read log files when >>>>>> troubleshooting. I'd like to add a sudo line that gives me read-only >>>>>> rights to /var/log/ - is this possible? I've not found any example >>>>>> of limted rights like that - and I don't want to allow write access >>>>>> to anyone other than root. >>>>>> >>>>>> Anne >>>>> >>>>> Not really a KDE issue, but facl should work. $user will be your >>>>> userid. >>>>> >>>>> setfacl -R -m u:$user:r /var/log/ >>>>> >>>>> >>>>> >>>>> >>>>> This one will give you access to newly created logs files without >>>>> having to run the above again. >>>>> >>>>> >>>>> setfacl -d -R -m u:$user:r /var/log/ >>>> >>>> Thanks. Unfortunately it doesn't seem to work - kwrite still shows an >>>> empty file even though I can see the size of it indicating that it is >>>> quite big. >>>> >>>> Anne >>> >>> Which file in /var/log/ ? >>> >>> What does getfacl /var/log/<file> show? >> >> # file: var/log/dmesg >> # owner: root >> # group: root >> user::rw- >> user:anne:r-- >> group::r-- >> mask::r-- >> other::r-- >> >>> Does this work from a prompt? >>> >>> tail /var/log/<file> >> >> tail /var/log/dmesg >> -bash: /var/log/dmesg: Permission denied >> >> Anne > > Weird, you shouldn't even need to set a facl for /var/log/dmesg as other > already has read access via normal unix permissions. > > other::r-- > > > What are the rights on /var and /var/log ? > > getfacl /var > getfacl /var/log > [root@borg2 ~]# getfacl /var getfacl: Removing leading '/' from absolute path names # file: var # owner: root # group: root user::rwx group::r-x other::r-x [root@borg2 ~]# getfacl /var/log getfacl: Removing leading '/' from absolute path names # file: var/log # owner: root # group: root user::rwx user:anne:r-- group::r-x mask::r-x other::r-x Anne

On Monday 31 Oct 2011 12:21:10 Patrick Boutilier wrote: > On 10/31/2011 09:16 AM, Anne Wilson wrote: >> On Monday 31 Oct 2011 10:40:12 Patrick Boutilier wrote: >>> On 10/31/2011 07:33 AM, Anne Wilson wrote: >>>> I'm fed up of having to be root to read log files when troubleshooting. >>>> I'd like to add a sudo line that gives me read-only rights to /var/log/ >>>> - is this possible? I've not found any example of limted rights like >>>> that - and I don't want to allow write access to anyone other than >>>> root. >>>> >>>> Anne >>> >>> Not really a KDE issue, but facl should work. $user will be your userid. >>> >>> setfacl -R -m u:$user:r /var/log/ >>> >>> >>> >>> >>> This one will give you access to newly created logs files without having >>> to run the above again. >>> >>> >>> setfacl -d -R -m u:$user:r /var/log/ >> >> Thanks. Unfortunately it doesn't seem to work - kwrite still shows an >> empty file even though I can see the size of it indicating that it is >> quite big. >> >> Anne > > Which file in /var/log/ ? > > What does getfacl /var/log/<file> show? > > > > Does this work from a prompt? > > tail /var/log/<file> > confession - this is on my server, CentOS Anne

[root@borg2 ~]# > tail /var/log/dmesg -bash: /var/log/dmesg: Permission denied

On Monday 31 Oct 2011 10:40:12 Patrick Boutilier wrote: > On 10/31/2011 07:33 AM, Anne Wilson wrote: > > I'm fed up of having to be root to read log files when troubleshooting. > > I'd like to add a sudo line that gives me read-only rights to /var/log/ > > - is this possible? I've not found any example of limted rights like > > that - and I don't want to allow write access to anyone other than > > root.

> Not really a KDE issue, but facl should work. $user will be your userid. > > setfacl -R -m u:$user:r /var/log/ > > This one will give you access to newly created logs files without having > to run the above again. > > > setfacl -d -R -m u:$user:r /var/log/ Thanks. Unfortunately it doesn't seem to work - kwrite still shows an empty file even though I can see the size of it indicating that it is quite big.

On Monday 31 Oct 2011 12:25:37 Colin J Thomson wrote: > On Monday 31 Oct 2011 12:16:03 Anne Wilson wrote: > > On Monday 31 Oct 2011 10:40:12 Patrick Boutilier wrote: > > > On 10/31/2011 07:33 AM, Anne Wilson wrote: > > > > I'm fed up of having to be root to read log files when > > > > troubleshooting. I'd like to add a sudo line that gives me > > > > read-only rights to /var/log/ - is this possible? I've not found > > > > any example of limted rights like that - and I don't want to allow > > > > write access to anyone other than root. > > > > > > Not really a KDE issue, but facl should work. $user will be your > > > userid. > > > > > > setfacl -R -m u:$user:r /var/log/ > > > > > > This one will give you access to newly created logs files without > > > having to run the above again. > > > > > > > > > setfacl -d -R -m u:$user:r /var/log/ > > > > Thanks. Unfortunately it doesn't seem to work - kwrite still shows an > > empty file even though I can see the size of it indicating that it is > > quite big. > > Have you tried KSystemlog Anne, its part of kdeadmin I had forgotten about that, but... "The file '/var/log/syslog' doesn't exist - and it doesn't of course.

[...] setfacl -R -m u:$user:r /var/log/ setfacl -d -R -m u:$user:r /var/log/

On Monday 31 Oct 2011 12:27:56 Thomas Moschny wrote: > 2011/10/31 Patrick Boutilier&lt;boutilpj(a)ednet.ns.ca&gt;: >> [...] >> setfacl -R -m u:$user:r /var/log/ >> setfacl -d -R -m u:$user:r /var/log/ > > You also need to set x bits (note capital X): > setfacl -R -m u:$user:rX /var/log/ > setfacl -d -R -m u:$user:rX /var/log/ > [root@borg2 ~]# setfacl -R -m u:anne:rX /var/log/ [root@borg2 ~]# setfacl -d -R -m u:anne:rX /var/log/ [root@borg2 ~]#> tail /var/log/dmesg -bash: /var/log/dmesg: Permission denied Hmm - am I missing something? Anne

On Monday 31 Oct 2011 12:44:11 Patrick Boutilier wrote: > As root what does ls -l /var/log/dmesg show? > [root@borg2 ~]# ls -l /var/log/dmesg -rw-r--r--+ 1 root root 37927 Oct 15 17:52 /var/log/dmesg I hadn't realised it before, but even for root the tail command is denied. Anne

On Monday 31 Oct 2011 13:15:56 Patrick Boutilier wrote: > On 10/31/2011 10:15 AM, Anne Wilson wrote: >> On Monday 31 Oct 2011 12:44:11 Patrick Boutilier wrote: >>> As root what does ls -l /var/log/dmesg show? >> >> [root@borg2 ~]# ls -l /var/log/dmesg >> -rw-r--r--+ 1 root root 37927 Oct 15 17:52 /var/log/dmesg >> >> I hadn't realised it before, but even for root the tail command is >> denied. >> >> Anne > > selinux maybe? > Disabled

Anne

On Monday 31 Oct 2011 12:27:56 Thomas Moschny wrote: > 2011/10/31 Patrick Boutilier <boutilpj(a)ednet.ns.ca&gt;: > > [...] > > setfacl -R -m u:$user:r /var/log/ > > setfacl -d -R -m u:$user:r /var/log/ > > You also need to set x bits (note capital X): > setfacl -R -m u:$user:rX /var/log/ > setfacl -d -R -m u:$user:rX /var/log/ > [root@borg2 ~]# setfacl -R -m u:anne:rX /var/log/ [root@borg2 ~]# setfacl -d -R -m u:anne:rX /var/log/ [root@borg2 ~]# > tail /var/log/dmesg -bash: /var/log/dmesg: Permission denied Hmm - am I missing something?