Add mask and group ownership to logs

snap/hooks/install

@@ -22,6 +22,7 @@ sed -i "s:/var/lib/mongodb:$SNAP_COMMON/var/lib/mongodb:g" $MONGO_CONFIG_FILE
 sed -i "s:/var/run:/tmp:g" $MONGO_CONFIG_FILE
 
 # Change ownership of snap directories to allow snap_daemon to read/write
-chown -R 584788:root ${SNAP_DATA}/*
-chown -R 584788:root ${SNAP_COMMON}/*
-
+chown -R 584788:root "${SNAP_DATA}"/*
+chown -R 584788:root "${SNAP_COMMON}"/*
+chgrp root "${SNAP_COMMON}/var/log/"*
+chmod g+s "${SNAP_COMMON}/var/log/"*

snap/local/start-mongod.sh

@@ -1,5 +1,14 @@
 #!/bin/bash
 
 # For security measures, daemons should not be run as sudo. Execute mongod as the non-sudo user: snap-daemon.
-exec $SNAP/usr/bin/setpriv --clear-groups --reuid snap_daemon \
-  --regid snap_daemon -- $SNAP/usr/bin/mongod --config ${SNAP_DATA}/etc/mongod/mongod.conf ${MONGOD_ARGS} "$@"
+exec \
+  "${SNAP}/usr/bin/setpriv" \
+  --clear-groups \
+  --reuid snap_daemon \
+  --regid snap_daemon \
+  -- \
+  "${SNAP}/usr/bin/mongod" \
+      --config "${SNAP_DATA}/etc/mongod/mongod.conf" \
+      --setParameter processUmask=037 \
+      "${MONGOD_ARGS}" \
+      "$@"