I'm fed up of having to be root to read log files when troubleshooting. I'd like to add a sudo line that gives me read-only rights to /var/log/ - is this possible? I've not found any example of limted rights like that - and I don't want to allow write access to anyone other than root.
Anne
On 10/31/2011 07:33 AM, Anne Wilson wrote:
I'm fed up of having to be root to read log files when troubleshooting. I'd like to add a sudo line that gives me read-only rights to /var/log/ - is this possible? I've not found any example of limted rights like that - and I don't want to allow write access to anyone other than root.
Anne
Not really a KDE issue, but facl should work. $user will be your userid.
setfacl -R -m u:$user:r /var/log/
This one will give you access to newly created logs files without having to run the above again.
setfacl -d -R -m u:$user:r /var/log/
On Monday 31 Oct 2011 10:40:12 Patrick Boutilier wrote:
On 10/31/2011 07:33 AM, Anne Wilson wrote:
I'm fed up of having to be root to read log files when troubleshooting. I'd like to add a sudo line that gives me read-only rights to /var/log/ - is this possible? I've not found any example of limted rights like that
- and I don't want to allow write access to anyone other than root.
Anne
Not really a KDE issue, but facl should work. $user will be your userid.
setfacl -R -m u:$user:r /var/log/
This one will give you access to newly created logs files without having to run the above again.
setfacl -d -R -m u:$user:r /var/log/
Thanks. Unfortunately it doesn't seem to work - kwrite still shows an empty file even though I can see the size of it indicating that it is quite big.
Anne
On 10/31/2011 09:16 AM, Anne Wilson wrote:
On Monday 31 Oct 2011 10:40:12 Patrick Boutilier wrote:
On 10/31/2011 07:33 AM, Anne Wilson wrote:
I'm fed up of having to be root to read log files when troubleshooting. I'd like to add a sudo line that gives me read-only rights to /var/log/ - is this possible? I've not found any example of limted rights like that
- and I don't want to allow write access to anyone other than root.
Anne
Not really a KDE issue, but facl should work. $user will be your userid.
setfacl -R -m u:$user:r /var/log/
This one will give you access to newly created logs files without having to run the above again.
setfacl -d -R -m u:$user:r /var/log/
Thanks. Unfortunately it doesn't seem to work - kwrite still shows an empty file even though I can see the size of it indicating that it is quite big.
Anne
Which file in /var/log/ ?
What does getfacl /var/log/<file> show?
Does this work from a prompt?
tail /var/log/<file>
On Monday 31 Oct 2011 12:16:03 Anne Wilson wrote:
On Monday 31 Oct 2011 10:40:12 Patrick Boutilier wrote:
On 10/31/2011 07:33 AM, Anne Wilson wrote:
I'm fed up of having to be root to read log files when troubleshooting. I'd like to add a sudo line that gives me read-only rights to /var/log/
- is this possible? I've not found any example of limted rights like
that - and I don't want to allow write access to anyone other than root.
Not really a KDE issue, but facl should work. $user will be your userid.
setfacl -R -m u:$user:r /var/log/
This one will give you access to newly created logs files without having to run the above again.
setfacl -d -R -m u:$user:r /var/log/
Thanks. Unfortunately it doesn't seem to work - kwrite still shows an empty file even though I can see the size of it indicating that it is quite big.
Have you tried KSystemlog Anne, its part of kdeadmin
Colin
On Monday 31 Oct 2011 12:16:03 Anne Wilson wrote:
On Monday 31 Oct 2011 10:40:12 Patrick Boutilier wrote:
On 10/31/2011 07:33 AM, Anne Wilson wrote:
I'm fed up of having to be root to read log files when troubleshooting. I'd like to add a sudo line that gives me read-only rights to /var/log/
- is this possible? I've not found any example of limted rights like
that - and I don't want to allow write access to anyone other than root.
Anne
Not really a KDE issue, but facl should work. $user will be your userid.
setfacl -R -m u:$user:r /var/log/
This one will give you access to newly created logs files without having to run the above again.
setfacl -d -R -m u:$user:r /var/log/
Thanks. Unfortunately it doesn't seem to work - kwrite still shows an empty file even though I can see the size of it indicating that it is quite big.
I first tried the numerical ID, but after reading the man page (your command pointed me to it - I didn't know which command I would need) I tried it as user:anne. Sadly neither seem to work :-(
Anne
On Monday 31 Oct 2011 12:21:10 Patrick Boutilier wrote:
On 10/31/2011 09:16 AM, Anne Wilson wrote:
On Monday 31 Oct 2011 10:40:12 Patrick Boutilier wrote:
On 10/31/2011 07:33 AM, Anne Wilson wrote:
I'm fed up of having to be root to read log files when troubleshooting. I'd like to add a sudo line that gives me read-only rights to /var/log/
- is this possible? I've not found any example of limted rights like
that - and I don't want to allow write access to anyone other than root.
Anne
Not really a KDE issue, but facl should work. $user will be your userid.
setfacl -R -m u:$user:r /var/log/
This one will give you access to newly created logs files without having to run the above again.
setfacl -d -R -m u:$user:r /var/log/
Thanks. Unfortunately it doesn't seem to work - kwrite still shows an empty file even though I can see the size of it indicating that it is quite big.
Anne
Which file in /var/log/ ?
What does getfacl /var/log/<file> show?
# file: var/log/dmesg # owner: root # group: root user::rw- user:anne:r-- group::r-- mask::r-- other::r--
Does this work from a prompt?
tail /var/log/<file>
tail /var/log/dmesg -bash: /var/log/dmesg: Permission denied
Anne
2011/10/31 Patrick Boutilier boutilpj@ednet.ns.ca:
[...] setfacl -R -m u:$user:r /var/log/ setfacl -d -R -m u:$user:r /var/log/
You also need to set x bits (note capital X): setfacl -R -m u:$user:rX /var/log/ setfacl -d -R -m u:$user:rX /var/log/
- Thomas
On Monday 31 Oct 2011 12:21:10 Patrick Boutilier wrote:
On 10/31/2011 09:16 AM, Anne Wilson wrote:
On Monday 31 Oct 2011 10:40:12 Patrick Boutilier wrote:
On 10/31/2011 07:33 AM, Anne Wilson wrote:
I'm fed up of having to be root to read log files when troubleshooting. I'd like to add a sudo line that gives me read-only rights to /var/log/
- is this possible? I've not found any example of limted rights like
that - and I don't want to allow write access to anyone other than root.
Anne
Not really a KDE issue, but facl should work. $user will be your userid.
setfacl -R -m u:$user:r /var/log/
This one will give you access to newly created logs files without having to run the above again.
setfacl -d -R -m u:$user:r /var/log/
Thanks. Unfortunately it doesn't seem to work - kwrite still shows an empty file even though I can see the size of it indicating that it is quite big.
Anne
Which file in /var/log/ ?
What does getfacl /var/log/<file> show?
Does this work from a prompt?
tail /var/log/<file>
confession - this is on my server, CentOS
Anne
On 10/31/2011 09:27 AM, Anne Wilson wrote:
On Monday 31 Oct 2011 12:21:10 Patrick Boutilier wrote:
On 10/31/2011 09:16 AM, Anne Wilson wrote:
On Monday 31 Oct 2011 10:40:12 Patrick Boutilier wrote:
On 10/31/2011 07:33 AM, Anne Wilson wrote:
I'm fed up of having to be root to read log files when troubleshooting. I'd like to add a sudo line that gives me read-only rights to /var/log/
- is this possible? I've not found any example of limted rights like
that - and I don't want to allow write access to anyone other than root.
Anne
Not really a KDE issue, but facl should work. $user will be your userid.
setfacl -R -m u:$user:r /var/log/
This one will give you access to newly created logs files without having to run the above again.
setfacl -d -R -m u:$user:r /var/log/
Thanks. Unfortunately it doesn't seem to work - kwrite still shows an empty file even though I can see the size of it indicating that it is quite big.
Anne
Which file in /var/log/ ?
What does getfacl /var/log/<file> show?
# file: var/log/dmesg # owner: root # group: root user::rw- user:anne:r-- group::r-- mask::r-- other::r--
Does this work from a prompt?
tail /var/log/<file>
tail /var/log/dmesg -bash: /var/log/dmesg: Permission denied
Anne
Weird, you shouldn't even need to set a facl for /var/log/dmesg as other already has read access via normal unix permissions.
other::r--
What are the rights on /var and /var/log ?
getfacl /var getfacl /var/log
On 10/31/2011 09:28 AM, Anne Wilson wrote:
On Monday 31 Oct 2011 12:21:10 Patrick Boutilier wrote:
On 10/31/2011 09:16 AM, Anne Wilson wrote:
On Monday 31 Oct 2011 10:40:12 Patrick Boutilier wrote:
On 10/31/2011 07:33 AM, Anne Wilson wrote:
I'm fed up of having to be root to read log files when troubleshooting. I'd like to add a sudo line that gives me read-only rights to /var/log/
- is this possible? I've not found any example of limted rights like
that - and I don't want to allow write access to anyone other than root.
Anne
Not really a KDE issue, but facl should work. $user will be your userid.
setfacl -R -m u:$user:r /var/log/
This one will give you access to newly created logs files without having to run the above again.
setfacl -d -R -m u:$user:r /var/log/
Thanks. Unfortunately it doesn't seem to work - kwrite still shows an empty file even though I can see the size of it indicating that it is quite big.
Anne
Which file in /var/log/ ?
What does getfacl /var/log/<file> show?
Does this work from a prompt?
tail /var/log/<file>
confession - this is on my server, CentOS
Anne
5.x or 6.x ? On 6.x other does not have rights to /var/log . Fix with:
setfacl -m u:anne:rx /var/log
On Monday 31 Oct 2011 12:33:14 Patrick Boutilier wrote:
On 10/31/2011 09:27 AM, Anne Wilson wrote:
On Monday 31 Oct 2011 12:21:10 Patrick Boutilier wrote:
On 10/31/2011 09:16 AM, Anne Wilson wrote:
On Monday 31 Oct 2011 10:40:12 Patrick Boutilier wrote:
On 10/31/2011 07:33 AM, Anne Wilson wrote:
I'm fed up of having to be root to read log files when troubleshooting. I'd like to add a sudo line that gives me read-only rights to /var/log/ - is this possible? I've not found any example of limted rights like that - and I don't want to allow write access to anyone other than root.
Anne
Not really a KDE issue, but facl should work. $user will be your userid.
setfacl -R -m u:$user:r /var/log/
This one will give you access to newly created logs files without having to run the above again.
setfacl -d -R -m u:$user:r /var/log/
Thanks. Unfortunately it doesn't seem to work - kwrite still shows an empty file even though I can see the size of it indicating that it is quite big.
Anne
Which file in /var/log/ ?
What does getfacl /var/log/<file> show?
# file: var/log/dmesg # owner: root # group: root user::rw- user:anne:r-- group::r-- mask::r-- other::r--
Does this work from a prompt?
tail /var/log/<file>
tail /var/log/dmesg -bash: /var/log/dmesg: Permission denied
Anne
Weird, you shouldn't even need to set a facl for /var/log/dmesg as other already has read access via normal unix permissions.
other::r--
What are the rights on /var and /var/log ?
getfacl /var getfacl /var/log
[root@borg2 ~]# getfacl /var getfacl: Removing leading '/' from absolute path names # file: var # owner: root # group: root user::rwx group::r-x other::r-x
[root@borg2 ~]# getfacl /var/log getfacl: Removing leading '/' from absolute path names # file: var/log # owner: root # group: root user::rwx user:anne:r-- group::r-x mask::r-x other::r-x
Anne
On 10/31/2011 09:40 AM, Anne Wilson wrote:
On Monday 31 Oct 2011 12:33:14 Patrick Boutilier wrote:
On 10/31/2011 09:27 AM, Anne Wilson wrote:
On Monday 31 Oct 2011 12:21:10 Patrick Boutilier wrote:
On 10/31/2011 09:16 AM, Anne Wilson wrote:
On Monday 31 Oct 2011 10:40:12 Patrick Boutilier wrote:
On 10/31/2011 07:33 AM, Anne Wilson wrote: > I'm fed up of having to be root to read log files when > troubleshooting. I'd like to add a sudo line that gives me read-only > rights to /var/log/ - is this possible? I've not found any example > of limted rights like that - and I don't want to allow write access > to anyone other than root. > > Anne
Not really a KDE issue, but facl should work. $user will be your userid.
setfacl -R -m u:$user:r /var/log/
This one will give you access to newly created logs files without having to run the above again.
setfacl -d -R -m u:$user:r /var/log/
Thanks. Unfortunately it doesn't seem to work - kwrite still shows an empty file even though I can see the size of it indicating that it is quite big.
Anne
Which file in /var/log/ ?
What does getfacl /var/log/<file> show?
# file: var/log/dmesg # owner: root # group: root user::rw- user:anne:r-- group::r-- mask::r-- other::r--
Does this work from a prompt?
tail /var/log/<file>
tail /var/log/dmesg -bash: /var/log/dmesg: Permission denied
Anne
Weird, you shouldn't even need to set a facl for /var/log/dmesg as other already has read access via normal unix permissions.
other::r--
What are the rights on /var and /var/log ?
getfacl /var getfacl /var/log
[root@borg2 ~]# getfacl /var getfacl: Removing leading '/' from absolute path names # file: var # owner: root # group: root user::rwx group::r-x other::r-x
[root@borg2 ~]# getfacl /var/log getfacl: Removing leading '/' from absolute path names # file: var/log # owner: root # group: root user::rwx user:anne:r-- group::r-x mask::r-x other::r-x
Anne
Weird. Directories have rx for "other" and the the file has r for "other". Anybody should be able to read /var/log/dmesg.
On Monday 31 Oct 2011 12:27:56 Thomas Moschny wrote:
2011/10/31 Patrick Boutilier boutilpj@ednet.ns.ca:
[...] setfacl -R -m u:$user:r /var/log/ setfacl -d -R -m u:$user:r /var/log/
You also need to set x bits (note capital X): setfacl -R -m u:$user:rX /var/log/ setfacl -d -R -m u:$user:rX /var/log/
[root@borg2 ~]# setfacl -R -m u:anne:rX /var/log/ [root@borg2 ~]# setfacl -d -R -m u:anne:rX /var/log/ [root@borg2 ~]# > tail /var/log/dmesg -bash: /var/log/dmesg: Permission denied
Hmm - am I missing something?
Anne
On 10/31/2011 09:43 AM, Anne Wilson wrote:
On Monday 31 Oct 2011 12:27:56 Thomas Moschny wrote:
2011/10/31 Patrick Boutilierboutilpj@ednet.ns.ca:
[...] setfacl -R -m u:$user:r /var/log/ setfacl -d -R -m u:$user:r /var/log/
You also need to set x bits (note capital X): setfacl -R -m u:$user:rX /var/log/ setfacl -d -R -m u:$user:rX /var/log/
[root@borg2 ~]# setfacl -R -m u:anne:rX /var/log/ [root@borg2 ~]# setfacl -d -R -m u:anne:rX /var/log/ [root@borg2 ~]#> tail /var/log/dmesg -bash: /var/log/dmesg: Permission denied
Hmm - am I missing something?
Anne
As root what does ls -l /var/log/dmesg show?
On Monday 31 Oct 2011 12:25:37 Colin J Thomson wrote:
On Monday 31 Oct 2011 12:16:03 Anne Wilson wrote:
On Monday 31 Oct 2011 10:40:12 Patrick Boutilier wrote:
On 10/31/2011 07:33 AM, Anne Wilson wrote:
I'm fed up of having to be root to read log files when troubleshooting. I'd like to add a sudo line that gives me read-only rights to /var/log/ - is this possible? I've not found any example of limted rights like that - and I don't want to allow write access to anyone other than root.
Not really a KDE issue, but facl should work. $user will be your userid.
setfacl -R -m u:$user:r /var/log/
This one will give you access to newly created logs files without having to run the above again.
setfacl -d -R -m u:$user:r /var/log/
Thanks. Unfortunately it doesn't seem to work - kwrite still shows an empty file even though I can see the size of it indicating that it is quite big.
Have you tried KSystemlog Anne, its part of kdeadmin
I had forgotten about that, but...
"The file '/var/log/syslog' doesn't exist - and it doesn't of course.
Anne
On Monday 31 Oct 2011 12:37:52 Patrick Boutilier wrote:
confession - this is on my server, CentOS
5.x or 6.x ? On 6.x other does not have rights to /var/log . Fix with:
6.x
setfacl -m u:anne:rx /var/log
[root@borg2 ~]# setfacl -m u:anne:rx /var/log [root@borg2 ~]# > tail /var/log/dmesg -bash: /var/log/dmesg: Permission denied
Anne
On Monday 31 Oct 2011 12:45:18 Anne Wilson wrote:
On Monday 31 Oct 2011 12:25:37 Colin J Thomson wrote:
On Monday 31 Oct 2011 12:16:03 Anne Wilson wrote:
On Monday 31 Oct 2011 10:40:12 Patrick Boutilier wrote:
On 10/31/2011 07:33 AM, Anne Wilson wrote:
I'm fed up of having to be root to read log files when troubleshooting. I'd like to add a sudo line that gives me read-only rights to /var/log/ - is this possible? I've not found any example of limted rights like that - and I don't want to allow write access to anyone other than root.
Not really a KDE issue, but facl should work. $user will be your userid.
setfacl -R -m u:$user:r /var/log/
This one will give you access to newly created logs files without having to run the above again.
setfacl -d -R -m u:$user:r /var/log/
Thanks. Unfortunately it doesn't seem to work - kwrite still shows an empty file even though I can see the size of it indicating that it is quite big.
Have you tried KSystemlog Anne, its part of kdeadmin
I had forgotten about that, but...
"The file '/var/log/syslog' doesn't exist - and it doesn't of course.
That's right, but you can set (from memory) the default log it looks at on startup
Colin
On Monday 31 Oct 2011 12:44:11 Patrick Boutilier wrote:
As root what does ls -l /var/log/dmesg show?
[root@borg2 ~]# ls -l /var/log/dmesg -rw-r--r--+ 1 root root 37927 Oct 15 17:52 /var/log/dmesg
I hadn't realised it before, but even for root the tail command is denied.
Anne
On 10/31/2011 10:15 AM, Anne Wilson wrote:
On Monday 31 Oct 2011 12:44:11 Patrick Boutilier wrote:
As root what does ls -l /var/log/dmesg show?
[root@borg2 ~]# ls -l /var/log/dmesg -rw-r--r--+ 1 root root 37927 Oct 15 17:52 /var/log/dmesg
I hadn't realised it before, but even for root the tail command is denied.
Anne
selinux maybe?
On Monday 31 Oct 2011 13:15:56 Patrick Boutilier wrote:
On 10/31/2011 10:15 AM, Anne Wilson wrote:
On Monday 31 Oct 2011 12:44:11 Patrick Boutilier wrote:
As root what does ls -l /var/log/dmesg show?
[root@borg2 ~]# ls -l /var/log/dmesg -rw-r--r--+ 1 root root 37927 Oct 15 17:52 /var/log/dmesg
I hadn't realised it before, but even for root the tail command is denied.
Anne
selinux maybe?
Disabled
Anne
On 10/31/2011 10:31 AM, Anne Wilson wrote:
On Monday 31 Oct 2011 13:15:56 Patrick Boutilier wrote:
On 10/31/2011 10:15 AM, Anne Wilson wrote:
On Monday 31 Oct 2011 12:44:11 Patrick Boutilier wrote:
As root what does ls -l /var/log/dmesg show?
[root@borg2 ~]# ls -l /var/log/dmesg -rw-r--r--+ 1 root root 37927 Oct 15 17:52 /var/log/dmesg
I hadn't realised it before, but even for root the tail command is denied.
Anne
selinux maybe?
Disabled
I am out of ideas. :-(
Anne
On Monday 31 Oct 2011 13:37:59 Patrick Boutilier wrote:
I am out of ideas. :-(
Thanks for trying, though
Anne
2011/10/31 Anne Wilson cannewilson@googlemail.com:
[root@borg2 ~]# > tail /var/log/dmesg -bash: /var/log/dmesg: Permission denied
Well, if you really typed what you quoted here, that's not surprising: You tried to _execute_ /var/log/dmesg and redirect the output to a "tail" file in the current working directory. Could you try again without the ">", please?
- Thomas
On Mon, Oct 31, 2011 at 8:43 AM, Anne Wilson cannewilson@googlemail.com wrote:
On Monday 31 Oct 2011 12:27:56 Thomas Moschny wrote:
2011/10/31 Patrick Boutilier boutilpj@ednet.ns.ca:
[...] setfacl -R -m u:$user:r /var/log/ setfacl -d -R -m u:$user:r /var/log/
You also need to set x bits (note capital X): setfacl -R -m u:$user:rX /var/log/ setfacl -d -R -m u:$user:rX /var/log/
[root@borg2 ~]# setfacl -R -m u:anne:rX /var/log/ [root@borg2 ~]# setfacl -d -R -m u:anne:rX /var/log/ [root@borg2 ~]# > tail /var/log/dmesg -bash: /var/log/dmesg: Permission denied
Hmm - am I missing something?
Do you have ACLs enabled on that mountpoint?
On Monday 31 Oct 2011 15:46:21 Thomas Moschny wrote:
2011/10/31 Anne Wilson cannewilson@googlemail.com:
[root@borg2 ~]# > tail /var/log/dmesg -bash: /var/log/dmesg: Permission denied
Well, if you really typed what you quoted here, that's not surprising: You tried to _execute_ /var/log/dmesg and redirect the output to a "tail" file in the current working directory. Could you try again without the ">", please?
Argh!! The perils of pasting then using history. Actually that's why I always include the command when asked to give an output - it allows the reader to catch the thing that I've been looking past and not seeing.
You are quite right, it does work now. Thanks for spotting it. Meanwhile I've learned how to set and get ACL permissions. Thanks to all who tried to help and apologies for any wasted time.
Anne
-
Andrew Parker -
Anne Wilson -
Colin J Thomson -
Patrick Boutilier -
Thomas Moschny