The setting of these policies needs to be figured out sensibly.
One of my great complaints about several Linux distributions is that
they keep forcing log files to be readable only by root, even though
they do put the adm group in their default group file -- the adm group
is traditionally the group allowed to read log files.
It is a *good* thing for a *restricted set* of users to have *readonly*
access to this kind of information -- i.e., a group. It is *not* a good
thing for system security or reliability to force the administrator to
assert root privileges to merely monitor information.
-hpa
--
