logrotate doesn't honor file ACL

SUSE Product Topics SLES Configure-Administer
1

I’ve set an extended file acl, through setfacl, granting a user read rights
to /var/log/messages This works like a charm.
However every time the file is rotated through logrotate the extended file
acl gets lost.
In /etc/logrotate.d/syslog the following is defined;

/var/log/warn /var/log/messages /var/log/allmessages /var/log/localmessages /var/log/firewall /var/log/acpid /var/log/NetworkManager {
compress
dateext
maxage 365
rotate 99
missingok
notifempty
size +4096k
create 640 root root
sharedscripts
postrotate
/etc/init.d/syslog reload > /dev/null
endscript
}

This tells logrotate to create a new file with permissions 640 with owner root:root
I’m guessing this is what causes the extended acl to be dropped. As far I know logrotate
should keep the existing permissions of the file when creating the new one, or am I wrong?
What needs to be done to keep the existing config for how /var/log/messages is rotated while
keep the extended acl permission as well?

Thanks

2

On 30/10/2013 10:14, jdoeconsulting wrote:
[color=blue]

I’ve set an extended file acl, through setfacl, granting a user read
rights
to /var/log/messages This works like a charm.
However every time the file is rotated through logrotate the extended
file
acl gets lost.
In /etc/logrotate.d/syslog the following is defined;

/var/log/warn /var/log/messages /var/log/allmessages
/var/log/localmessages /var/log/firewall /var/log/acpid
/var/log/NetworkManager {
compress
dateext
maxage 365
rotate 99
missingok
notifempty
size +4096k
create 640 root root
sharedscripts
postrotate
/etc/init.d/syslog reload > /dev/null
endscript
}

This tells logrotate to create a new file with permissions 640 with
owner root:root
I’m guessing this is what causes the extended acl to be dropped. As far
I know logrotate
should keep the existing permissions of the file when creating the new
one, or am I wrong?
What needs to be done to keep the existing config for how
/var/log/messages is rotated while
keep the extended acl permission as well?[/color]

Whilst you can use the logrotate “create” directive to set the mode,
owner, and/or group of the new log file (see below) this doesn’t (re)set
the ACLs.

–begin–
create mode owner group
Immediately after rotation (before the postrotate script is run)
the log file is created (with the same name as the log file just
rotated). mode specifies the mode for the log file in octal
(the same as chmod(2)), owner specifies the user name who will
own the log file, and group specifies the group the log file
will belong to. Any of the log file attributes may be omitted,
in which case those attributes for the new file will use the
same values as the original log file for the omitted attributes.
This option can be disabled using the nocreate option.
—end—

What you can do instead (or as well) is use the “postrotate” directive
to (re)set the ACLs

–begin–
postrotate/endscript
The lines between postrotate and endscript (both of which must
appear on lines by themselves) are executed (using /bin/sh)
after the log file is rotated. These directives may only appear
inside a log file definition. Normally, the absolute path to the
log file is passed as first argument to the script. If shared-
scripts is specified, whole pattern is passed to the script.
See also prerotate. See sharedscripts and nosharedscripts for
error handling.
—end—

So for the example you gave, add your setfacl command(s) above the
“endscript” directive which will give you something like

–begin–
/var/log/warn /var/log/messages /var/log/allmessages
/var/log/localmessages /var/log/firewall /var/log/acpid
/var/log/NetworkManager {
compress
dateext
maxage 365
rotate 99
missingok
notifempty
size +4096k
create 640 root root
sharedscripts
postrotate
/etc/init.d/syslog reload > /dev/null
/path/to/setfacl …
endscript
}
—end—

HTH.

Simon
SUSE Knowledge Partner

If you find this post helpful and are logged into the web interface,
please show your appreciation and click on the star below. Thanks.

3

Looks like this may be fixed in newer code too, give or take in logrotate
3.7.9. It may be worth trying in case these changes have been backported
into the latest version that SLES ships, though I do not see it in the
changelog on my SLES 11 SP3 system currently:

http://svn.fedorahosted.org/svn/logrotate/tags/r3-8-7/CHANGES

–
Good luck.

If you find this post helpful and are logged into the web interface,
show your appreciation and click on the star below…

4

Thanks Simon,

I thought about going that route to reset the ACL in the postrotate script.
But just as ab points out I noticed when searching on this one that there
was a bug report for this issue in the Red Hat bugzilla.
Just as ab notes it seems the fix is not yet in the SLES distro so SLES
have the same issue.

I’ll go with the postrotate script to fix the issue at hand.

Thanks

5

Yes I noticed that.
I’ll use the postrotate script to fix the issue at hand.

Thanks!

6

On 30/10/2013 14:14, jdoeconsulting wrote:
[color=blue]

I thought about going that route to reset the ACL in the postrotate
script.
But just as ab points out I noticed when searching on this one that
there
was a bug report for this issue in the Red Hat bugzilla.
Just as ab notes it seems the fix is not yet in the SLES distro so SLES
have the same issue.[/color]

You didn’t say which version of SLES you’re using but checking packages
and updates for SLES11 SP1-SP3 it seems the version of logrotate SUSE
are using is version 3.7.7 with some security fixes backported.

HTH.

Simon
SUSE Knowledge Partner

If you find this post helpful and are logged into the web interface,
please show your appreciation and click on the star below. Thanks.

7

Simon,

I’m sorry I missed informing you that I was running with SLES 11 SP2.

Anyhow I’ve implemented the fix by using the postrotate script to run
the setfacl command and it works just fine.

Thanks!

8

On 31/10/2013 08:34, jdoeconsulting wrote:
[color=blue]

I’m sorry I missed informing you that I was running with SLES 11 SP2.[/color]

No problem. In this case it doesn’t seem to make a difference (SLES11
SPx = logrotate 3.7.7) but most of the time it’s important to note.
[color=blue]

Anyhow I’ve implemented the fix by using the postrotate script to run
the setfacl command and it works just fine.[/color]

That’s good to hear, thanks for the report back.

Simon
SUSE Knowledge Partner

If you find this post helpful and are logged into the web interface,
please show your appreciation and click on the star below. Thanks.