Dear Maintainer,

  I have noticed that atop as a default will produce its log in a
read-for-all mode :

  drwxr-xr-x 2 root root     4096 Nov  2 00:00 /var/log/atop
  -rw-r--r-- 1 root root 20422954 Nov  2 12:57 /var/log/atop/atop_20261102

  Atop runs as root and capture informations that not everybody is
deemed to access, such as for instance program name and args. In this
configuration any user on the same host can run `atop -r` and have a
full view on all processes, without any restrictions that /proc would
usually enforce.

  I have tested with success a simple, patch: simply add those two
statements in the systemd unit file :

  [Service]
  ...
  UMask=0027
  Group=adm

  The umask will restrict access to user and group only, and the running
group is necessary because atop does create the log file : it would be
racy and ackward to `chown` the file after the fact. Changing the
running group has no effect on atop as far as I could test (I ran this
for 2 days). The umask/group also obviously works fine or the `mkdir`
called from ExecStartPre.

  With this fix I get :

  drwxr-x--- 2 root adm     4096 Nov  3 00:00 /var/log/atop
  -rw-r----- 1 root adm  9823451 Nov  3 00:00 /var/log/atop/atop_20261102

  And only users in the 'adm' group may reach this information.

  Since this fix would only work for new atop installations, it might be
necessary to retroactively patch in a postinst, those commands will do -
and are idempotent :

  chmod -R o-rwx /var/log/atop
  chgrp -R adm /var/log/atop

  Thanks !