From bdb2060407df9c798fd8460b8aaa1c395d7a16b4 Mon Sep 17 00:00:00 2001
From: Sadeep Madurange <sadeep@asciimx.com>
Date: Mon, 17 Aug 2026 07:30:10 +0800
Subject: Move cgi log to /var/log, set group permissions for queue, remove log
 truncate logic: use newsyslog.

---
 lex.cgi | 23 ++++++++++++++---------
 1 file changed, 14 insertions(+), 9 deletions(-)

(limited to 'lex.cgi')

diff --git a/lex.cgi b/lex.cgi
index 797fa1c..ea181c7 100755
--- a/lex.cgi
+++ b/lex.cgi
@@ -37,30 +37,24 @@ BEGIN {
 	};
 }
 
+my $log_dir = "/var/log";
 my $base_dir = "/var/lex";
 my $keyring_file = "$base_dir/pubring.gpg";
 
 unveil("/dev/null", "rw") or die "unveil /dev/null failed: $!";
+unveil($log_dir, "rwc") or die "unveil $base_dir failed: $!";
 unveil($base_dir, "rwc") or die "unveil $base_dir failed: $!";
 unveil() or die "unveil lock failed: $!";
 
 pledge('stdio rpath wpath cpath flock') or die "pledge failed: $!";
 
 my $dop = 5;
-my $log_file = "$base_dir/debug.log";
+my $log_file = "$log_dir/lexcgi.log";
 my $max_log_bytes = 1024 * 1024; # 1 MB cap
 
 sub log_msg {
 	my ($msg) = @_;
 
-	# Truncate if >$max_log_bytes
-	if (-e $log_file && -s $log_file >= $max_log_bytes) {
-		my $clrh;
-		if (open($clrh, '>', $log_file)) {
-			close($clrh);
-		}
-	}
-
 	my $lh;
 	if (open($lh, '>>', $log_file)) {
 		my $tz_offset = 8 * 3600;
@@ -226,14 +220,25 @@ unless (length($plain_text) > 0) {
 	respond_ok();
 }
 
+# Set umask so group gets read/write (0666 & ~0007 = 0660)
+my $old_umask = umask(007);
 my $queue_file = "$base_dir/queue.txt";
+my $is_new = ! -e $queue_file;
+
 my $qfh;
 unless (open($qfh, '>>:utf8', $queue_file)) {
 	log_msg("ERROR: Failed to append to $queue_file: $!");
 	respond_ok();
 }
+
+if ($is_new) {
+	my $tool_gid = getgrnam('tool');
+	chown -1, $tool_gid, $queue_file;
+}
+
 print $qfh $plain_text . "\n";
 close($qfh);
+umask($old_umask);
 
 my $elapsed_ms = sprintf("%.2fms", (time() - $start_time) * 1000);
 my $msg_id = sprintf("msg_%.6f_$$", time());
-- 
cgit v1.2.3