CentOS中Java日志的权限管理
一 基本原则与运行身份
二 目录与文件权限的标准做法
sudo mkdir -p /var/log/myappsudo chown -R appuser:appuser /var/log/myapp755(rwxr-xr-x),文件644(rw-r–r–)
sudo find /var/log/myapp -type d -exec chmod 755 {} +sudo find /var/log/myapp -type f -exec chmod 644 {} +sudo groupadd loggerssudo chown -R appuser:loggers /var/log/myapp && sudo chmod 750 /var/log/myappsudo find /var/log/myapp -type f -exec chmod 640 {} +sudo usermod -aG loggers alice(重新登录生效)三 日志轮转与保留策略
/var/log/myapp/*.log {
daily
missingok
rotate 30
compress
delaycompress
notifempty
create 640 appuser loggers
sharedscripts
postrotate
/bin/kill -USR1 $(cat /var/run/myapp.pid 2>/dev/null) 2>/dev/null || true
endscript
}
640与正确的属主/属组;按需设置保留天数与压缩,降低泄露与占满磁盘的风险。四 SELinux与ACL的进阶控制
sudo chcon -R -t var_log_t /var/log/myappsemanage fcontext持久化,或用restorecon -R /var/log/myapp恢复。sudo setfacl -m u:bob:r-- /var/log/myapp/app.loggetfacl /var/log/myapp/app.logausearch -m avc -ts recent),再决定是调整上下文还是改用ACL。五 常见故障排查清单
ps -eo pid,user,cmd | grep java,确保是appuser而非root或其他用户。sudo -u appuser touch /var/log/myapp/test.logls -ld /var/log/myapp /var/log/myapp/*.log