I have tested and confirmed that after rebooting, permissions are reset on /var/log back to whatever is the default for each distro/version listed below. The question is, why?

  • CentOS 7
  • Ubuntu >= 15.04
  • Debian 8/9

From what I can tell, the default permissions for CentOS 7 and Debian 8/9 are 755, root:root. The default permissions for Ubuntu 15.04+ are 775, root:syslog. If I install upstream rsyslog from the PPA, then the default permissions become 755 (confirmed on Ubuntu 16.04, presumably for versions of Ubuntu between 15.04 and 16.04 also).

Any attempt to change the permissions on /var/log from the default result in a reset, presumably on the next boot. I read someone's suggestion on a related post that it could be the rsyslog settings at work, but I toggled those settings to match my expectations and even went with some that wouldn't work (e.g., 700) and the result was still the same: reset back to whatever is the default.

I then uninstalled rsyslog (a VM with a stock rsyslog install, another with upstream rsyslog) and the permissions were still reset, so evidently the reset work is not done by rsyslog.

Is this something specific to systemd? Is this a setting I can actually override and have "stick" between reboots?

Thank you in advance for any help that you can provide.


My testing was performed on simple installations of the distro using LVM, but with one volume in an attempt to rule out mount options for the lv being the problem.

  • @JeffSchaller thanks, I saw that after posting earlier. That was my next place to dig and see if it was something I could change. I assume that I can (somehow) as installing rsyslog (upstream) alters whatever value is being set on /var/log. – deoren Jul 10 '17 at 1:09

I'm still digging into the specifics, but it looks like these files play a role in the permissions management of /var/log at boot time:

  • /usr/lib/tmpfiles.d/var.conf
  • /usr/lib/tmpfiles.d/00rsyslog.conf

Ironically I found them when I ran grep -ri '/var/log' /var/log on an Ubuntu 16.04 box and saw this message:

./syslog.1:Jul  9 21:18:15 ubuntu-virtual-machine systemd-tmpfiles[616]: [/usr/lib/tmpfiles.d/var.conf:14] Duplicate line for path "/var/log", ignoring.

I looked in that file and found this:

#  This file is part of systemd.
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.

# See tmpfiles.d(5) for details

q /var 0755 - - -

L /var/run - - - - ../run

d /var/log 0755 - - -
f /var/log/wtmp 0664 root utmp -
f /var/log/btmp 0600 root utmp -

d /var/cache 0755 - - -

d /var/lib 0755 - - -

d /var/spool 0755 - - -

I started tweaking the values for the d /var/log 0755 - - - line, but with no discernable change from my efforts I looked around further in that directory and found the /usr/lib/tmpfiles.d/00rsyslog.conf file.

In that file:

# Override systemd's default tmpfiles.d/var.conf to make /var/log writable by
# the syslog group, so that rsyslog can run as user.
# See tmpfiles.d(5) for details.

# Type Path    Mode UID  GID  Age Argument
d /var/log 0775 root syslog -

root@ubuntu-virtual-machine:/usr/lib/tmpfiles.d# dpkg -S /usr/lib/tmpfiles.d/00rsyslog.conf

rsyslog: /usr/lib/tmpfiles.d/00rsyslog.conf

So the rsyslog package provides a conf include file that attempts to override the values set within the tmpfiles.d/var.conf conf file.

The result is that when I uninstall rsyslog, the tmpfiles.d/var.conf conf file settings apply, which in this case is 0755.

I'll need to research further into whether tmpfiles.d is intended only for package maintainers or whether sysadmins also need to manages files within that area.


Turns out that there are three directories, with the first having greatest precedence (and intended for admins to use in order to override settings from the other two):

  1. /etc/tmpfiles.d/*.conf
  2. /run/tmpfiles.d/*.conf
  3. /usr/lib/tmpfiles.d/*.conf

More info:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.