> Date: Wednesday, August 12, 2015 09:28:59 -0400 > From: m.roth at 5-cent.us > > Jonathan Billings wrote: >> On Tue, Aug 11, 2015 at 12:59:58PM -0400, m.roth at 5-cent.us wrote: >>> So, since I haven't yet found where /var/log/httpd is created, >>> what would >>> a default package make the ownership of the directory? Does it >>> expect it to be apache:root? >> >> Just a data point: >> >> $ rpm -qp --qf='[%-11{filemodes:perms} %-8{fileusername} >> %-8{filegroupname} %{filenames}\n]' >> httpd-2.2.15-45.el6.x86_64.rpm | grep /var/log/httpd >> >> drwx------ root root /var/log/httpd >> > Yeah, well, SiteMinder runs as a child of the httpd started by > service start, so it runs as apache. > > Ask me how much I think of SiteMinder... offlist, if you want the > rant.... > > mark !@#$@!#$!@#~!@ > That's "fine" (within context), but then it shouldn't be able to write to files in the /var/log/httpd directory. [from something you posted I got the sense that it owned that directory, which is even worse (especially for a "security tool"), if that was correct.] Assuming any ability to configure things, change it's logging to an application-specific directory. The long-and-short is that at some point someone/thing changed the permissions (and maybe ownerships) on /var/log/httpd from the defaults. [something that i would have assumed would have gone into your change-management system.]