From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from pigeon.gentoo.org ([208.92.234.80] helo=lists.gentoo.org) by finch.gentoo.org with esmtp (Exim 4.60) (envelope-from <gentoo-user+bounces-127413-garchives=archives.gentoo.org@lists.gentoo.org>) id 1QxdK4-00066E-UK for garchives@archives.gentoo.org; Sun, 28 Aug 2011 11:14:41 +0000 Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 2917621C2DE; Sun, 28 Aug 2011 11:14:32 +0000 (UTC) Received: from mail-wy0-f181.google.com (mail-wy0-f181.google.com [74.125.82.181]) by pigeon.gentoo.org (Postfix) with ESMTP id 5B71821C2BB for <gentoo-user@lists.gentoo.org>; Sun, 28 Aug 2011 11:13:32 +0000 (UTC) Received: by wyg36 with SMTP id 36so4546915wyg.40 for <gentoo-user@lists.gentoo.org>; Sun, 28 Aug 2011 04:13:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=from:reply-to:to:subject:date:user-agent:references:in-reply-to :mime-version:content-type:content-transfer-encoding:message-id; bh=dPTDaNFjqizr0hn9/I1vylDdM5xgDIjgRIR92/ZnmT8=; b=KfYmLMFBuhD3wX43dUX52M0fvI4XYHSdqnfNkP548v9iXQpZ3YM3BqoDy2pYK9rmVG oCRsEjGmBsKhF+/guJeUtd0SINFE3vu6LdYsH9vzruoqh2VR+18znbj68gNaAGXijzCe zr3buoBOm6MqgR07J1rFjhE5AkNU4YtroJecc= Received: by 10.216.158.65 with SMTP id p43mr3509877wek.71.1314530011464; Sun, 28 Aug 2011 04:13:31 -0700 (PDT) Received: from dell_xps.localnet (230.3.169.217.in-addr.arpa [217.169.3.230]) by mx.google.com with ESMTPS id n20sm2816633wbh.33.2011.08.28.04.13.29 (version=TLSv1/SSLv3 cipher=OTHER); Sun, 28 Aug 2011 04:13:30 -0700 (PDT) From: Mick <michaelkintzios@gmail.com> To: gentoo-user@lists.gentoo.org Subject: Re: [gentoo-user] logrotate: /var/log/portage/elog "insecure permissions"? Date: Sun, 28 Aug 2011 12:14:11 +0100 User-Agent: KMail/1.13.7 (Linux/2.6.39-gentoo-r3; KDE/4.6.5; x86_64; ; ) References: <4E3C0AD2.6080409@gmail.com> <201108070122.11290.michaelkintzios@gmail.com> <4E3EAD32.1060106@binarywings.net> In-Reply-To: <4E3EAD32.1060106@binarywings.net> Precedence: bulk List-Post: <mailto:gentoo-user@lists.gentoo.org> List-Help: <mailto:gentoo-user+help@lists.gentoo.org> List-Unsubscribe: <mailto:gentoo-user+unsubscribe@lists.gentoo.org> List-Subscribe: <mailto:gentoo-user+subscribe@lists.gentoo.org> List-Id: Gentoo Linux mail <gentoo-user.gentoo.org> X-BeenThere: gentoo-user@lists.gentoo.org Reply-to: gentoo-user@lists.gentoo.org MIME-Version: 1.0 Content-Type: multipart/signed; boundary="nextPart2001346.53TiYStrEC"; protocol="application/pgp-signature"; micalg=pgp-sha1 Content-Transfer-Encoding: 7bit Message-Id: <201108281214.16339.michaelkintzios@gmail.com> X-Archives-Salt: X-Archives-Hash: 48fb6f4d3f7410fde8d65c439d386b55 --nextPart2001346.53TiYStrEC Content-Type: Text/Plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable On Sunday 07 Aug 2011 16:20:18 Florian Philipp wrote: > Am 07.08.2011 02:22, schrieb Mick: > > On Friday 05 Aug 2011 23:08:38 Neil Bothwick wrote: > >> On Fri, 05 Aug 2011 17:59:00 +0200, Florian Philipp wrote: > >>> Yes, this was introduced in 3.8.0 to fix security issues [1]. Change > >>> your config to look like this: > >>> /var/log/portage/elog/summary.log { > >>> su portage portage > >>> ... > >>> } > >>>=20 > >>> Disclaimer: I've not really tried this (yet) but I think I'm able to > >>> read changelogs and man-pages. ;-) > >>=20 > >> Yes that fixes it. The latest portage ebuilds include an updated config > >> file. > >=20 > > Hmm ... it still complains here! > >=20 > > error: error setting owner of > > /var/log/portage/elog/summary.log-20110801.gz: Operation not permitted > >=20 > >=20 > > This is my /etc/logrotate.d/elog-save-summary: > > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > > /var/log/portage/elog/summary.log { > >=20 > > su portage portage > > =20 > > missingok > > nocreate > > delaycompress > >=20 > > } > > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > >=20 > > # ls -la /var/log/portage/elog/summary.log > > -rw-rw-r-- 1 root portage 4326 Aug 6 09:44 > > /var/log/portage/elog/summary.log > >=20 > > Can you see anything amiss? >=20 > At least on my system, /var/log/portage has the following permissions: > drwxr-xr-x root root >=20 > Only root can write, therefore the config must read >=20 > /var/log/portage/elog/summary.log { > su root portage > missingok > nocreate > delaycompress > } The latest logrotate update wanted to change the above line from su root=20 portage to su portage portage ... Should I be changing the ownership of /var/log/portage and /var/log/portage= =20 elog? =2D-=20 Regards, Mick --nextPart2001346.53TiYStrEC Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.17 (GNU/Linux) iEYEABECAAYFAk5aIwgACgkQVTDTR3kpaLbZMgCgquGFLgzZ6L6ayM3V7wHY07Ph PgMAoLSb4L88N51yHrVuGGT4NXKnltN5 =ELtU -----END PGP SIGNATURE----- --nextPart2001346.53TiYStrEC--