Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Are there any concerns about the security of logrotate running as root? Had someone ask couldn't a malicious user subvert the config to overwrite anything? Is is okay to run logrotate out of the cron of another user?

share|improve this question
add comment

3 Answers

If the logrotate config is writable only by root, you shouldn't have any problems with people changing it to overwrite random files. If you wanted to run it as another user, you'd have to ensure that user had access to change all the log files you want rotated, which will add complexity with very little return.

share|improve this answer
add comment

As long as the user can write and create files in the directory with your log files, you can use another user. However, if your logrotate config is editable only by root, then I don't see much risk there. If someone can subvert that they can gain root and can cause far more harm than just messing up with log files, so the concerns, while certainly exist, do not really justify customizing a standard app such as logrotate.

share|improve this answer
add comment

Typically any user should be able to run logrotate, but you need to override both the default state file and the default configuration. This is fairly easy to do looking at the man pages:

% /usr/sbin/logrotate --state ~/mylogrotate.status ~/mylogrotate.conf

Otherwise, as a non-root user you won't be able to change the state file or do fancy things like restart services you don't own.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.