Comment # 12 on bug 1178154 from Matthias Gerstner

(In reply to kukuk@suse.com from comment #11)
> If other log files (which?) should be owned by the audit group, the name of
> the group "audit" would be wrong and we need something better.

I don't think anybody said that the group should be named "audit" when shared
among multiple packages.

> But I don't see a valid usecase for other log files.

If there are indeed so few logfiles around then this might be a valid point. A
quick look into my Tumbleweed installation shows files like:

- /var/log/boot.log
- /var/log/firewalld
- /var/log/NetworkManager
- /var/log/snapper.log
- /var/log/wpa_supplicant.log
- /var/log/zypper.log

All of these are not world-readable any more. A quick look in the ARCHIVE.gz
shows possible further candidates like:

- /var/log/radius/radius.log    -rw-------
- /var/log/rkhunter.log         -rw-r-----
- /var/log/sphinx/query.log     -rw-r-----
- /var/log/sphinx/searched.log  -rw-r-----
- /var/log/dracut.log           -rw-r----

How much sense it makes to apply a shared group to any of these packages/files
is another question that is open for discussion.