System log files are world readable

+++ b/gnu/services.scm

+                      (define (ensure-file-exists file)

+                        (let ((port (open-file file "a0")))

+                          (chmod port #o640)

+                          (close-port port)))

+

+                      (ensure-file-exists "/var/run/utmpx")

+                      (ensure-file-exists "/var/log/wtmp")

+++ b/gnu/services/base.scm

+      (start #~(let ((fork (make-forkexec-constructor

+                            (list #$(syslog-configuration-syslogd config)

+                                  "--rcfile"

+                                  #$(syslog-configuration-config-file config))

+                            #:pid-file "/var/run/syslog.pid")))

+                 (lambda ()

+                   ;; Set the umask such that file permissions are #o640.

+                   (let ((mask (umask #o137))

+                         (pid  (fork)))

+                     (umask mask)

+                     pid))))

+++ b/modules/shepherd/service.scm

+             (dup2 (open-fdes log-file (logior O_CREAT O_WRONLY O_APPEND) #o640) 1)

+++ b/doc/shepherd.texi

+  [#:file-creation-mask #f] @

+the current directory to @var{directory}, sets the umask to

+@var{file-creation-mask} unless it is @code{#f}, changes the environment to

+  [#:file-creation-mask #f] @

+  [#:file-creation-mask #f] @

+Run @var{command} as the current process from @var{directory}, with

+@var{file-creation-mask} if it's true, and with

+++ b/modules/shepherd/service.scm

+                       (file-creation-mask #f)

+  "Run COMMAND as the current process from DIRECTORY, with FILE-CREATION-MASK

+if it's true, and with ENVIRONMENT-VARIABLES (a list of strings like

+\"PATH=/bin\").  File descriptors 1 and 2 are kept as is or redirected to

+LOG-FILE if it's true, whereas file descriptor 0 (standard input) points to

+/dev/null; all other file descriptors are closed prior to yielding control to

+COMMAND.

+     (when file-creation-mask

+       (umask file-creation-mask))

+

+                            (file-creation-mask #f)

+                      #:file-creation-mask file-creation-mask

+the current directory to @var{directory}, sets the umask to

+@var{file-creation-mask} unless it is @code{#f}, changes the environment to

+               (file-creation-mask #f)

+                                        #:file-creation-mask file-creation-mask

+++ b/tests/file-creation-mask.sh

+# GNU Shepherd --- Test the #:file-creation-mask option of 'make-forkexec-constructor'.

+# Copyright © 2020 Diego N. Barbato <dnbarbato@posteo.de>

+#

+# This file is part of the GNU Shepherd.

+#

+# The GNU Shepherd is free software; you can redistribute it and/or modify it

+# under the terms of the GNU General Public License as published by

+# the Free Software Foundation; either version 3 of the License, or (at

+# your option) any later version.

+#

+# The GNU Shepherd is distributed in the hope that it will be useful, but

+# WITHOUT ANY WARRANTY; without even the implied warranty of

+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

+# GNU General Public License for more details.

+#

+# You should have received a copy of the GNU General Public License

+# along with the GNU Shepherd.  If not, see <http://www.gnu.org/licenses/>.

+

+shepherd --version

+herd --version

+

+socket="t-socket-$$"

+conf="t-conf-$$"

+log="t-log-$$"

+pid="t-pid-$$"

+service_log="t-service-log-$$"

+service_new_file="t-service-new-file-$$"

+

+herd="herd -s $socket"

+

+trap "cat $log || true;

+      rm -f $socket $conf $log $service_log $service_new_file;

+      test -f $pid && kill \`cat $pid\` || true; rm -f $pid" EXIT

+

+function wait_for_file

+{

+    i=0

+    while ! test -f "$1" && test $i -lt 20

+    do

+	sleep 0.3

+	i=`expr $i + 1`

+    done

+    test -f "$1"

+}

+

+cat > "$conf"<<EOF

+(define %command

+  '("$SHELL" "-c" "touch $PWD/$service_new_file; echo foo"))

+

+(register-services

+ (make <service>

+   #:provides '(test)

+   #:start (make-forkexec-constructor %command

+                                      #:log-file "$PWD/$service_log"

+                                      ;; Set the umask such that file

+                                      ;; permissions are #o600.

+                                      #:file-creation-mask #o177)

+   #:stop (make-kill-destructor)

+   #:respawn? #f))

+EOF

+

+rm -f "$pid"

+shepherd -I -s "$socket" -c "$conf" -l "$log" --pid="$pid" &

+

+# Wait till it's ready.

+wait_for_file "$pid"

+

+# Start the service.

+$herd start test

+

+# Make sure the log file is created with the right permissions independently

+# of the value of #:file-creation-mask.

+wait_for_file "$service_log"

+test `stat -c %a "$service_log"` -eq 640

+

+# Make sure the service creates files with the right permissions as determined

+# by the value of #:file-creation-mask.

+wait_for_file "$service_new_file"

+test `stat -c %a "$service_new_file"` -eq 600