triage notes:     
"""
mbasti: it looks like these logs (ipactl.log, default.log) are created by something else (systemd?) and they contain text from stderr

I suspect that ipactl.log is STDERR output from `systemctl start ipa`

IPA default logger setup has permission 0o600
"""

Upstream ticket:
https://fedorahosted.org/freeipa/ticket/6104

These are logs created via the context log in ipalib/plugable.py and not by standard ipa logger.

We can approach this in one of two ways:

If the log doesn't exist:
    create it
    chmod it to 0600

or

If the log doesn't exist:
     create it
chmod it to 0600

Something like:

diff --git a/ipalib/plugable.py b/ipalib/plugable.py
index 4c2782dbf..899805b46 100644
--- a/ipalib/plugable.py
+++ b/ipalib/plugable.py
@@ -521,6 +521,9 @@ class API(ReadOnly):
         if self.env.log is not None:
             try:
                 handler = logging.FileHandler(self.env.log)
+                if not os.path.exists(self.env.log):
+                    open(self.env.log, 'a').close()
+                os.chmod(self.env.log, 0o600)
             except IOError as e:
                 logger.error('Cannot open log file %r: %s', self.env.log, e)
             else:


I don't know why a user would want to temporarily change the mode of the log file and the second method would tighten up perms on existing context logs once the context is used again.

This BZ has been evaluated multiple times over the last several years and we assessed that it is a valuable request to keep in the backlog and address it at some point in future. Time showed that we did not have such capacity, nor have it now nor will have in the foreseeable future. In such a situation keeping it in the backlog is misleading and setting the wrong expectation that we will be able to address it. Unfortunately we will not. To reflect this we are closing this BZ. If you disagree with the decision please reopen or open a new support case and create a new BZ. However this does not guarantee that the request will not be closed during the triage as we are currently applying much more rigor to what we actually can accomplish in the foreseeable future. Contributions and collaboration in the upstream community and CentOS Stream is always welcome!
Thank you for understanding.
Red Hat Enterprise Linux Identity Management Team

The needinfo request[s] on this closed bug have been removed as they have been unresolved for 1000 days