read only with setfacl

setfacl-read-only.sh

group="hadoop-admins"

dirs="
  /var/log/ambari-agent
  /var/log/ambari-server
  /var/log/ambari-infra-solr
  /var/log/ambari-infra-solr-client
  /var/log/ambari-logsearch-logfeeder
  /var/log/ambari-logsearch-portal
  /var/log/ambari-metrics-agent
  /var/log/ambari-metrics-collector
  /var/log/ambari-metrics-grafana
  /var/log/ambari-metrics-monitor
  /var/log/atlas
  /var/log/druid
  /var/log/hadoop
  /var/log/hadoop-httpfs
  /var/log/hadoop-mapreduce
  /var/log/hadoop-yarn
  /var/log/hadoop/httpfs
  /var/log/hbase
  /var/log/hive
  /var/log/hive2
  /var/log/hive-hcatalog
  /var/log/hst
  /var/log/infra-solr-client
  /var/log/kafka
  /var/log/knox
  /var/log/livy2
  /var/log/nifi
  /var/log/nifi-registry
  /var/log/oozie
  /var/log/ranger/admin
  /var/log/ranger/kms
  /var/log/ranger/tagsync
  /var/log/ranger/usersync
  /var/log/registry
  /var/log/smartsense-activity
  /var/log/spark
  /var/log/spark2
  /var/log/superset
  /var/log/webchat
  /var/log/zeppelin
  /var/log/zookeeper
"

for dir in ${dirs}; do
  sudo setfacl -d -m "g:${group}:rX" "${dir}"
  sudo setfacl -R -m "g:${group}:rX" "${dir}"
done