Proper way to protect a logs directory

Question

When hardening a WAS (in this case I am using Tomcat), OWASP recommends to apply this Linux permissions to the logs directory:

Make sure tomcat user has read/write access to /tmp and write (300 - yes, only write/execute) access to CATALINA_HOME/logs

Can someone explain why is the harm in allowing read permission (since using it simplifies management via remote tools without having to use sudo)

---

EDIT

After the answers, I think I understand better the issue and how to combine security with convenience. I suppose a solution could be to use

• use permissions 350
• change owner to tomcat:admin
• run the aplication with user tomcat, so if it is exploited, the user will not have read access to the logs, but the users in the admin group will, so they can check the logs with their tools remotely.

Answer 1

In the case of web server logs, allowing read could potentially allow remote users to read sensitive data from the system, if any compromise was found in the running web applications. On the other hand, by only allowing write access, the web server logs could potentially contain fraudulent entries, but any sensitive data in the files should remain secure.

Depending on the type of vulnerability, it might be possible for an attack to escalate their privileges, but that's an extra step to possibly get useful information, which could be enough to put them off. A lot of attackers are mostly interested in low-hanging fruit, so keeping the permissions to the minimum level required for a service to run is a good habit.