Bug 2375213

When the sssd-common package introduced a change to the permissions of the log files in /var/log/sssd/, this was added to the RPM %postinstall scriptlet:

/usr/bin/chown -f sssd:sssd /var/log/sssd/*.log || true

(Ref: https://src.fedoraproject.org/rpms/sssd/blob/f42/f/sssd.spec#_1119 )

However, there is also a logrotate configuration in sssd-common that rotates and compresses the log files /var/log/sssd/*.log, and it also has "su sssd sssd" in the configuration. (Ref: https://github.com/SSSD/sssd/blob/master/src/examples/logrotate.in)

If sssd had been running before the transition to using sssd user/groups for log file ownership, there were several root:root owned files that had been rotated earlier.  However, logrotate can no longer rotate them because their permissions were restricted to root and logrotate is running as sssd:sssd.

You'll get an error that looks like:

logrotate[61244]: error: unable to open /var/log/sssd/sssd_pam.log-20250511 (read-only) for compression: Permission denied

This causes the logrotate.service to error out immediately, rather than continuing to rotate log files.

I think the glob in the rpm %post install scriptlet should be changed to /var/log/sssd/*.log* to address this.

Reproducible: Always