Bug 1559801 - [Ganesha] : logrotate cron task skips ganesha logs since /var/log/ganesha is world writable.
Summary: [Ganesha] : logrotate cron task skips ganesha logs since /var/log/ganesha is ...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Gluster Storage
Classification: Red Hat Storage
Component: nfs-ganesha
Version: rhgs-3.4
Hardware: x86_64
OS: Linux
unspecified
high
Target Milestone: ---
: RHGS 3.4.0
Assignee: Kaleb KEITHLEY
QA Contact: Manisha Saini
URL:
Whiteboard:
Depends On:
Blocks: 1503137
TreeView+ depends on / blocked
 
Reported: 2018-03-23 10:01 UTC by Ambarish
Modified: 2018-09-24 10:55 UTC (History)
11 users (show)

Fixed In Version: nfs-ganesha-1.5.5-5
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-09-04 06:54:24 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHEA-2018:2610 0 None None None 2018-09-04 06:55:33 UTC

Description Ambarish 2018-03-23 10:01:01 UTC
Description of problem:
------------------------

logrotate is complaining about rotating ganesha logs coz of insecure permissions :


<snip>

Content-Type: text/plain; charset="UTF-8"
Subject: Anacron job 'cron.daily' on gqas007.sbu.lab.eng.bos.redhat.com

/etc/cron.daily/logrotate:

error: skipping "/var/log/ganesha/ganesha.log" because parent directory has insecure permissions (It's world writable or writable by group which is not "root") Set "su" directive in config file to tell logrotate which user/group should be used for rotation.
error: skipping "/var/log/ganesha/ganesha-gfapi.log" because parent directory has insecure permissions (It's world writable or writable by group which is not "root") Set "su" directive in config file to tell logrotate which user/group should be used for rotation.

</snip>


[root@gqas013 ~]# ls -ld /var/log/ganesha/
drwxrwxr-x. 2 ganesha ganesha 50 Mar 22 10:15 /var/log/ganesha/


[root@gqas013 ~]# ls -ld /var/log/ganesha/ganesha.log 
-rw-r--r--. 1 root root 269817 Mar 23 05:55 /var/log/ganesha/ganesha.log
[root@gqas013 ~]# 



Version-Release number of selected component (if applicable):
-------------------------------------------------------------

glusterfs-ganesha-3.12.2-5.el7rhgs.x86_64
nfs-ganesha-gluster-2.5.5-3.el7rhgs.x86_64


How reproducible:
------------------

100%

Comment 2 Ambarish 2018-03-23 10:03:32 UTC
Missing su here :

[root@gqas013 ~]# cat /etc/logrotate.d/ganesha
/var/log/ganesha/ganesha.log {
    weekly
    rotate 52
    copytruncate
    dateext
    compress
    missingok
}



[root@gqas013 ~]# cat /etc/logrotate.d/ganesha-gfapi 
/var/log/ganesha/ganesha-gfapi.log {
    weekly
    rotate 52
    copytruncate
    dateext
    compress
    missingok
}
[root@gqas013 ~]#

Comment 3 Ambarish 2018-03-23 10:04:20 UTC
Would adding su ganesha ganesha fix it?

(I can give this a try later today)

Comment 4 Jiffin 2018-03-26 04:12:41 UTC
Yeah u can try that. Make sure add it in the beginning. Perform systemctl daemon-load post that. Then see whether log rotate works using logrotate command
logrotate -f /etc/logrotate.d/ganesha

Comment 5 Ambarish 2018-03-26 17:16:59 UTC
I'll have this by Thurs EOD.

Comment 6 Ambarish 2018-03-29 04:15:25 UTC
This doesnt seem to work :

[root@gqas016 ~]# logrotate -f /etc/logrotate.d/ganesha
error: error opening /var/log/ganesha/ganesha.log: Permission denied
[root@gqas016 ~]# 


[root@gqas016 ~]# cat /etc/logrotate.d/ganesha
/var/log/ganesha/ganesha.log {
    su ganesha ganesha
    weekly
    rotate 52
    copytruncate
    dateext
    compress
    missingok
}

Comment 7 Ambarish 2018-03-29 04:15:51 UTC
Anything else i can try?

Comment 8 Kaleb KEITHLEY 2018-03-29 11:46:10 UTC
I will set the mode correctly on the directory in the next build.

Please give qe ack (and hopefully we get the auto pm ack) so I can mark this BZ as Resolved

Comment 9 Kaleb KEITHLEY 2018-03-29 12:35:23 UTC
adding "su ganesha ganesha" won't/doesn't work. It needs to be "su root ganesha", at least until we have ganesha running as non-root.

Or we can change the perms on /var/log/ganesha to 0755 (currently at 0775).

The latter is a simple fix to the mkdir in the rpm .spec file.

Comment 10 Jiffin 2018-03-29 18:11:20 UTC
(In reply to Kaleb KEITHLEY from comment #8)
> I will set the mode correctly on the directory in the next build.
> 
> Please give qe ack (and hopefully we get the auto pm ack) so I can mark this
> BZ as Resolved

So u are suggesting the issue happened because of the mode for the directory 775 not because it is owned by ganesha user. I didn't understand why "su root ganesha" works but "su ganesha ganesha", Currently /var/log/ganesha is owned by "ganesha ganesha" and if understand option su, it mentions "su user group", so ideally it need to "su ganesha ganesha" IMO.

Comment 11 Kaleb KEITHLEY 2018-04-02 11:44:06 UTC
I don't see anything in the logrotate.conf man page that says user must be the same as the group, or the same os the log file owner.

AFAICT, "su root ganesha" is not wrong. (And log rotation works with it.)

And I still think changing the perms on /var/log/ganesha to 0755 is the simpler/better fix.

Comment 12 Ambarish 2018-04-02 11:59:23 UTC
I can confirm that adding "su root ganesha" works :

**DEFAULTS ** :

[root@gqas016 ~]# cat /etc/logrotate.d/ganesha
/var/log/ganesha/ganesha.log {
    weekly
    rotate 52
    copytruncate
    dateext
    compress
    missingok
}
[root@gqas016 ~]# 


[root@gqas016 ~]# logrotate -f /etc/logrotate.d/ganesha
error: skipping "/var/log/ganesha/ganesha.log" because parent directory has insecure permissions (It's world writable or writable by group which is not "root") Set "su" directive in config file to tell logrotate which user/group should be used for rotation.
[root@gqas016 ~]# 


** ADD su root ganesha ** :

[root@gqas016 ~]# cat /etc/logrotate.d/ganesha
/var/log/ganesha/ganesha.log {
    weekly
    rotate 52
    copytruncate
    dateext
    compress
    missingok
    su root ganesha
}

[root@gqas016 ~]# logrotate -f /etc/logrotate.d/ganesha
[root@gqas016 ~]#

Comment 13 Ambarish 2018-04-02 12:00:42 UTC
Changing permissions for /var/log/ganesha works as well (i understand that's the easier fix) . I hope it doesnt cause any other problems:

[root@gqas016 ~]# chmod  0777 /var/log/ganesha/

[root@gqas016 ~]# logrotate -f /etc/logrotate.d/ganesha
error: skipping "/var/log/ganesha/ganesha.log" because parent directory has insecure permissions (It's world writable or writable by group which is not "root") Set "su" directive in config file to tell logrotate which user/group should be used for rotation.
[root@gqas016 ~]# 



[root@gqas016 ~]# chmod  0755 /var/log/ganesha/
[root@gqas016 ~]# 

[root@gqas016 ~]# logrotate -f /etc/logrotate.d/ganesha
[root@gqas016 ~]#

Comment 16 Manisha Saini 2018-04-09 12:43:01 UTC
Able to repro the issue with 

# rpm -qa | grep ganesha
glusterfs-ganesha-3.12.2-7.el7rhgs.x86_64
nfs-ganesha-2.5.5-4.el7rhgs.x86_64
nfs-ganesha-gluster-2.5.5-4.el7rhgs.x86_64

# ll | grep ganesha
drwxrwxr-x. 2 ganesha   ganesha      50 Apr  9 16:31 ganesha


# ll ganesha/ 
total 120
-rw-------. 1 root root 95006 Apr  9 16:30 ganesha-gfapi.log
-rw-r--r--. 1 root root 23792 Apr  9 16:32 ganesha.log



# logrotate -f /etc/logrotate.d/ganesha
error: skipping "/var/log/ganesha/ganesha.log" because parent directory has insecure permissions (It's world writable or writable by group which is not "root") Set "su" directive in config file to tell logrotate which user/group should be used for rotation.

# logrotate -f /etc/logrotate.d/ganesha-gfapi 
error: skipping "/var/log/ganesha/ganesha-gfapi.log" because parent directory has insecure permissions (It's world writable or writable by group which is not "root") Set "su" directive in config file to tell logrotate which user/group should be used for rotation.


# cat /etc/logrotate.d/ganesha
/var/log/ganesha/ganesha.log {
    weekly
    rotate 52
    copytruncate
    dateext
    compress
    missingok
}
[root@dhcp37-191 log]# cat /etc/logrotate.d/ganesha-gfapi 
/var/log/ganesha/ganesha-gfapi.log {
    weekly
    rotate 52
    copytruncate
    dateext
    compress
    missingok
}

Moving this BZ to assigned state.

Comment 19 errata-xmlrpc 2018-09-04 06:54:24 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2018:2610


Note You need to log in before you can comment on or make changes to this bug.