Package: atop Version: 2.11.1-3 Severity: normal Tags: patch Dear Maintainer,
I have noticed that atop as a default will produce its log in a read-for-all mode : drwxr-xr-x 2 root root 4096 Nov 2 00:00 /var/log/atop -rw-r--r-- 1 root root 20422954 Nov 2 12:57 /var/log/atop/atop_20261102 Atop runs as root and capture informations that not everybody is deemed to access, such as for instance program name and args. In this configuration any user on the same host can run `atop -r` and have a full view on all processes, without any restrictions that /proc would usually enforce. I have tested with success a simple, patch: simply add those two statements in the systemd unit file : [Service] ... UMask=0027 Group=adm The umask will restrict access to user and group only, and the running group is necessary because atop does create the log file : it would be racy and ackward to `chown` the file after the fact. Changing the running group has no effect on atop as far as I could test (I ran this for 2 days). The umask/group also obviously works fine or the `mkdir` called from ExecStartPre. With this fix I get : drwxr-x--- 2 root adm 4096 Nov 3 00:00 /var/log/atop -rw-r----- 1 root adm 9823451 Nov 3 00:00 /var/log/atop/atop_20261102 And only users in the 'adm' group may reach this information. Since this fix would only work for new atop installations, it might be necessary to retroactively patch in a postinst, those commands will do - and are idempotent : chmod -R o-rwx /var/log/atop chgrp -R adm /var/log/atop Thanks ! -- System Information: Debian Release: 13.7 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 6.12.113+deb13-amd64 (SMP w/4 CPU threads; PREEMPT) Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages atop depends on: ii init-system-helpers 1.69~deb13u1 ii libc6 2.41-12+deb13u4 ii libglib2.0-0t64 2.84.4-3~deb13u5 ii libncursesw6 6.5+20250216-2 ii libtinfo6 6.5+20250216-2 ii zlib1g 1:1.3.dfsg+really1.3.1-1+b1 Versions of packages atop recommends: ii cron [cron-daemon] 3.0pl1-197 atop suggests no packages. -- Configuration Files: /etc/default/atop changed [not included] -- no debconf information
