3

Are there any concerns about the security of logrotate running as root? Had someone ask couldn't a malicious user subvert the config to overwrite anything? Is is okay to run logrotate out of the cron of another user?

3 Answers 3

3

As long as the user can write and create files in the directory with your log files, you can use another user. However, if your logrotate config is editable only by root, then I don't see much risk there. If someone can subvert that they can gain root and can cause far more harm than just messing up with log files, so the concerns, while certainly exist, do not really justify customizing a standard app such as logrotate.

2

If the logrotate config is writable only by root, you shouldn't have any problems with people changing it to overwrite random files. If you wanted to run it as another user, you'd have to ensure that user had access to change all the log files you want rotated, which will add complexity with very little return.

2

Typically any user should be able to run logrotate, but you need to override both the default state file and the default configuration. This is fairly easy to do looking at the man pages:

% /usr/sbin/logrotate --state ~/mylogrotate.status ~/mylogrotate.conf

Otherwise, as a non-root user you won't be able to change the state file or do fancy things like restart services you don't own.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .