Gfilui

I already found some solutions here: AWStats: cannot access /var/log/apache2/access.log, but this are "hammer-methods", like change ownership and so on. I do not like.

I want to understand what is going on (probably then I use one of this hammers)

What is the scenario: I have an user "myapp" (in my case the user my rails app uses)

myapp@myapp-pre ~/appdir$ id
uid=1000(myapp) gid=100(users) groups=100(users),4(adm),27(sudo)

As you can see the user has group "adm". Lets take a look at the log file

myapp@myapp-pre ~/appdir$ sudo ls -l /var/log/apache2/error.log
-rw-r----- 1 root adm 17503 Apr 28 17:05 /var/log/apache2/error.log

Here we see, that error.log belongs to root:adm - root(rw) - adm(r)

But not "sodoed":

myapp@myapp-pre ~/appdir$ ls -l /var/log/apache2/error.log
ls: cannot access /var/log/apache2/error.log: Permission denied 

If I take a look at the parent directory:

myapp@myapp-pre ~/appdir$ ls -l /var/log

...
-rw-r--r-- 1 root root 347 May 26 2017 alternatives.log.7.gz
-rw-r--r-- 1 root root 419 Mar 14 2017 alternatives.log.8.gz
-rw-r--r-- 1 root root 369 Feb 14 2017 alternatives.log.9.gz
dr-xr--r-T 2 root adm 4096 Apr 28 06:05 apache2
-rw-r----- 1 root adm 4013282 Apr 28 17:22 auth.log
-rw-r----- 1 root adm 4467467 Apr 23 06:05 auth.log.1
-rw-r----- 1 root adm 269469 Apr 15 06:05 auth.log.2.gz
...

I see, that many files have the same root:adm permissions, and user myapp can read them.

A try just to read the file

myapp@myapp-pre ~/appdir$ cat /var/log/apache2/error.log
cat: /var/log/apache2/error.log: Permission denied

same result ...

So why is my user "myapp" not allowed to read?