I have tested and confirmed that after rebooting, permissions are reset on
/var/log back to whatever is the default for each distro/version listed below. The question is, why?
- CentOS 7
- Ubuntu >= 15.04
- Debian 8/9
From what I can tell, the default permissions for CentOS 7 and Debian 8/9 are
root:root. The default permissions for Ubuntu 15.04+ are
root:syslog. If I install upstream rsyslog from the PPA, then the default permissions become
755 (confirmed on Ubuntu 16.04, presumably for versions of Ubuntu between 15.04 and 16.04 also).
Any attempt to change the permissions on
/var/log from the default result in a reset, presumably on the next boot. I read someone's suggestion on a related post that it could be the rsyslog settings at work, but I toggled those settings to match my expectations and even went with some that wouldn't work (e.g., 700) and the result was still the same: reset back to whatever is the default.
I then uninstalled rsyslog (a VM with a stock rsyslog install, another with upstream rsyslog) and the permissions were still reset, so evidently the reset work is not done by rsyslog.
Is this something specific to systemd? Is this a setting I can actually override and have "stick" between reboots?
Thank you in advance for any help that you can provide.
My testing was performed on simple installations of the distro using LVM, but with one volume in an attempt to rule out mount options for the lv being the problem.