What program specifically sets /var/log/boot.log to 644 perms in RHEL/Centos 6?

Question

I've been assigned to lock down all /var/log files so that they cannot be read except by the root user. I've been stumped by the /var/log/boot.log file. It seems that after every boot the file no matter what what previous permission state gets set to 644 permissions.

I've gone through the exercise of changing the umask in a number of key /etc/init.d files and functions to no avail.

Anybody got any idea as to the specific program doing this and maybe how to get the perms on /var/log/boot.log to be 600?

Answer 1

Via a fgrep -r boot.log /usr, it is plymouth to blame. The plymouth manual page is uh kinda lacking on Centos 6, though a romp through the source code does show that there is a no_boot_log option, apparently that can be set by passing no-boot-log somewhere (assuming you're okay with no logs from plymouth). Ah! With more digging there is a world_readable flag that twiddles the mode used for the open(2) call, except this is set only as the third argument to

        log_is_opened = ply_logger_open_file (session->logger, filename, true);

Sad trombone. Anyways, you'll probably be fiddling with the initrd image to customize this, or maybe filing bug reports with RedHat to a) write some damn docs so that less source code spelunking is required and b) offer an option somehow to configure that mode perhaps via kernel arg or something.

Answer 2

Upon contacting RHEL support for an answer here....

RHEL verifies that plymouth is to blame.

They point to a solutions document (https://access.redhat.com/site/solutions/66805 -- restricted to RHEL subscribers) that verifies that although there is a flag in the source code to open/create the log in a more restrictive mode, there is no way to set that flag from the outside (i.e. no option) as it is hardcoded to be world-readable.

The RHEL support document further indicates that putting a chmod in /etc/rc.d/rc.local scripting would be the way to make the permission change I desire.

Bummer!