Permissions defined in /etc/rsyslog.conf are not getting applied on /var/log/boot.log

Solution Verified - Updated -

Environment

  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • plymouth

Issue

  • Permissions defined in /etc/rsyslog.conf are not getting applied on /var/log/boot.log file.
  • Unable to change permissions permanently on /var/log/boot.log

Resolution

  • The boot.log is handled by Plymouth in Red Hat Enterprise Linux 6 & 7
  • It creates a new boot.log when the server is rebooted so the permissions changes after every reboot.

Resolution on RHEL6

You can change the permission of /var/log/boot.log file in /etc/rc.d/rc.local file, since /etc/rc.d/rc.local is the last file to be executed on every boot-up. You can below line :

chmod 600 /var/log/boot.log

Resolution on RHEL7

This issue was resolved with the update to plymouth in RHEL7.4

Update plymouth to plymouth-0.8.9-0.28.20140113.el7 or better.

Root Cause

  • In Red Hat Enterprise Linux 6 & 7, plymouth is the component responsible for recording those messages in /var/log/boot.log when the root filesystem becomes writeable. Red Hat Enterprise Linux 6 & 7 are based on a newer code base and will integrate the "Plymouth" boot infrastructure.

  • The permissions 644 are the only mode /var/log/boot.log is created with and its not configurable.

        ply_logger_open_file (ply_logger_t    *logger,
                              const char      *filename,
                              bool             world_readable)
        {
          int fd;
          mode_t mode;

          assert (logger != NULL);
          assert (filename != NULL);

          if (world_readable)
            mode = 0644;
          else
            mode = 0600;

          fd = open (filename, PLY_LOGGER_OPEN_FLAGS, mode);
  • Above function gets called as below:
           log_is_opened = ply_logger_open_file (session->logger, filename, true);
           if (log_is_opened)

and we can see that only "true" is always passed to word_readable which is going to make ply_logger_open_file() always open file with mode 0644.
File path "/var/log/boot.log" is constructed as given below:

             case PLY_MODE_BOOT:
               filename = PLYMOUTH_LOG_DIRECTORY "/boot.log";

    src/Makefile.in:307:           -DPLYMOUTH_LOG_DIRECTORY=\"$(localstatedir)/log\" 

    plymouth-0.8.3/INSTALL:32:./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var
  • That's why the permission's of /var/log/boot.log will be changed to default 0644 after reboot.

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.

Comments