Re: [gentoo-user] logrotate: /var/log/portage/elog "insecure permissions"?

[Mick <michaelkintzios@gmail.com>]

[-- Attachment #1: Type: Text/Plain, Size: 1775 bytes --]

On Sunday 07 Aug 2011 16:20:18 Florian Philipp wrote:
> Am 07.08.2011 02:22, schrieb Mick:
> > On Friday 05 Aug 2011 23:08:38 Neil Bothwick wrote:
> >> On Fri, 05 Aug 2011 17:59:00 +0200, Florian Philipp wrote:
> >>> Yes, this was introduced in 3.8.0 to fix security issues [1]. Change
> >>> your config to look like this:
> >>> /var/log/portage/elog/summary.log {
> >>> su portage portage
> >>> ...
> >>> }
> >>> 
> >>> Disclaimer: I've not really tried this (yet) but I think I'm able to
> >>> read changelogs and man-pages. ;-)
> >> 
> >> Yes that fixes it. The latest portage ebuilds include an updated config
> >> file.
> > 
> > Hmm ... it still complains here!
> > 
> > error: error setting owner of
> > /var/log/portage/elog/summary.log-20110801.gz: Operation not permitted
> > 
> > 
> > This is my /etc/logrotate.d/elog-save-summary:
> > ===================================
> > /var/log/portage/elog/summary.log {
> > 
> >  su portage portage
> >  
> >     missingok
> >     nocreate
> >     delaycompress
> > 
> > }
> > ===================================
> > 
> > # ls -la /var/log/portage/elog/summary.log
> > -rw-rw-r-- 1 root portage 4326 Aug  6 09:44
> > /var/log/portage/elog/summary.log
> > 
> > Can you see anything amiss?
> 
> At least on my system, /var/log/portage has the following permissions:
> drwxr-xr-x root root
> 
> Only root can write, therefore the config must read
> 
> /var/log/portage/elog/summary.log {
>  su root portage
>  missingok
>  nocreate
>  delaycompress
> }

The latest logrotate update wanted to change the above line from su root 
portage to su portage portage ...

Should I be changing the ownership of /var/log/portage and /var/log/portage 
elog?
-- 
Regards,
Mick

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 198 bytes --]