commit - 3bda540e3428e7e3a18ee1c54a65c449ca10f35e
commit + 4acf495f41d2c26136e99072293ca8b9bff91dc0
blob - d8f4e760eac8db95d28e22fb90db884ade255aea
blob + cc186d5e7ce14c92abb13f9723964dbac2e1decb
--- gmid.c
+++ gmid.c
@@ -322,16 +322,26 @@ static int
 main_send_logfd(struct conf *conf)
 {
 	struct privsep	*ps = conf->ps;
-	int		 fd = -1;
+	char		 path[PATH_MAX];
+	int		 r, fd = -1;
 
 	if (debug)
 		return 0;
 
 	if (conf->log_access) {
+		r = snprintf(path, sizeof(path), "%s%s%s", conf->chroot,
+		    *conf->chroot == '\0' ? "" : "/", conf->log_access);
+		if (r < 0 || (size_t)r >= sizeof(path)) {
+			log_warnx("path too long: %s", conf->log_access);
+			goto done;
+		}
+
 		fd = open(conf->log_access, O_WRONLY|O_CREAT|O_APPEND, 0600);
 		if (fd == -1)
 			log_warn("can't open %s", conf->log_access);
 	}
+
+ done:
 	if (proc_compose_imsg(ps, PROC_LOGGER, -1, IMSG_LOG_TYPE, -1, fd,
 	    NULL, 0) == -1)
 		return -1;
blob - dda781cdcdaf9f808a06c94e2e1e810d9f0790c6
blob + 2dd80b38016da957fd63d97329824991e74b8cca
--- gmid.conf.5
+++ gmid.conf.5
@@ -140,6 +140,8 @@ This is the default behaviour.
 .It Ic access Ar file
 Log the requests to
 .Ar file .
+The path is relative to the
+.Ic chroot .
 .El
 .It Ic prefork Ar number
 Run the specified number of server processes.