Bug 2299733 - logrotate service will fail to start due to improper permissions on /var/log/sssd directory
Summary: logrotate service will fail to start due to improper permissions on /var/log/...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: sssd
Version: 41
Hardware: x86_64
OS: Linux
unspecified
high
Target Milestone: ---
Assignee: Alexey Tikhonov
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
: 2315854 2316165 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-07-24 19:43 UTC by sponix2ipfw
Modified: 2024-10-19 09:56 UTC (History)
14 users (show)

Fixed In Version: sssd-2.10.0-1.fc41
Clone Of:
Environment:
Last Closed: 2024-10-17 23:11:45 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github SSSD sssd pull 7512 0 None closed BUILD: configure logrotate to work with non-root-group writable folder 2024-09-21 21:41:24 UTC

Description sponix2ipfw 2024-07-24 19:43:29 UTC
I see that the logrotate service has failed to start from within cockpit. In there it explains that this is due to improper permissions on /var/log/sssd directory. After a sudo chmod 755 /var/log/sssd I can start the logrotate service without issues. Pretty sure what I've done to resolve this is take the permissions from drwxrwxr-x to drwxr-xr-x on this directory.

Reproducible: Always

Steps to Reproduce:
1.Apply system updates that include sssd, have a look at services in cockpit
2.after seeing the logrotate service failed to start using sudo chmod 755 /var/log/sssd
3.clear the error, and start logrotate and it works as it should
Actual Results:  
Well, the steps above get logrotate running again. I am not sure how this may effect the sssd system itself though

Expected Results:  
it is expected to see logrotate service running without the need to use sudo chmod 755 /var/log/sssd

Comment 1 Alexey Tikhonov 2024-07-24 19:57:58 UTC
> In there it explains that this is due to improper permissions on /var/log/sssd directory.

Could you please quote error message/log?

> what I've done to resolve this is take the permissions from drwxrwxr-x to drwxr-xr-x on this directory

Depending on specific configuration, SSSD might need this folder to be group-writeable.

Comment 2 sponix2ipfw 2024-07-24 19:59:12 UTC
logrotate
error: skipping "/var/log/sssd/sssd_kcm.log" because parent directory has insecure permissions (It's world writable or writable by group which is not "root") Set "su" directive in config file to tell logrotate which user/group should be used for rotation.

Comment 3 Alexey Tikhonov 2024-07-25 12:03:56 UTC
Could you please check if addition of a line
```
su sssd sssd
```
to `/etc/logrotate.d/sssd` (inside {}, for example after "compress" line) resolves an issue for you?

Comment 4 sponix2ipfw 2024-07-26 01:24:55 UTC
(In reply to Alexey Tikhonov from comment #3)
> Could you please check if addition of a line
> ```
> su sssd sssd
> ```
> to `/etc/logrotate.d/sssd` (inside {}, for example after "compress" line)
> resolves an issue for you?

root@sponix:/etc/logrotate.d# cat sssd 
/var/log/sssd/*.log {
    weekly
    missingok
    notifempty
    sharedscripts
    rotate 2
    compress
    delaycompress
    su sssd sssd
    postrotate
        /bin/kill -HUP `cat /var/run/sssd.pid 2>/dev/null` 2> /dev/null || true
        /bin/pkill -HUP sssd_kcm 2> /dev/null || true
    endscript
}

within cockpit it no longer has the permission error given prior. But it still doesn't actually keep the logrotate service running either.

8:23 PM
Finished logrotate.service - Rotate log files.
systemd
8:23 PM
logrotate.service: Deactivated successfully.
systemd
8:23 PM
Starting logrotate.service - Rotate log files...

Maybe this is a user error. I feel that logrotate service is supposed to keep running. Is this wrong of me?

Comment 5 sponix2ipfw 2024-07-26 01:27:27 UTC
(In reply to Alexey Tikhonov from comment #1)
> > In there it explains that this is due to improper permissions on /var/log/sssd directory.
> 
> Could you please quote error message/log?
> 
> > what I've done to resolve this is take the permissions from drwxrwxr-x to drwxr-xr-x on this directory
> 
> Depending on specific configuration, SSSD might need this folder to be
> group-writeable.

I can get you any logging you would like to see. Just give me a command to dig it up, and I'll attach it.

Comment 6 Alexey Tikhonov 2024-07-26 09:35:53 UTC
(In reply to sponix2ipfw from comment #4)
> (In reply to Alexey Tikhonov from comment #3)
> > Could you please check if addition of a line
> > ```
> > su sssd sssd
> > ```
> > to `/etc/logrotate.d/sssd` (inside {}, for example after "compress" line)
> > resolves an issue for you?
> 
> root@sponix:/etc/logrotate.d# cat sssd 
> /var/log/sssd/*.log {
>     weekly
>     missingok
>     notifempty
>     sharedscripts
>     rotate 2
>     compress
>     delaycompress
>     su sssd sssd
>     postrotate
>         /bin/kill -HUP `cat /var/run/sssd.pid 2>/dev/null` 2> /dev/null ||
> true
>         /bin/pkill -HUP sssd_kcm 2> /dev/null || true
>     endscript
> }
> 
> within cockpit it no longer has the permission error given prior. But it
> still doesn't actually keep the logrotate service running either.
> 
> 8:23 PM
> Finished logrotate.service - Rotate log files.
> systemd
> 8:23 PM
> logrotate.service: Deactivated successfully.
> systemd
> 8:23 PM
> Starting logrotate.service - Rotate log files...
> 
> Maybe this is a user error. I feel that logrotate service is supposed to
> keep running. Is this wrong of me?

Frankly, I don't know.

Jan, could you please help here?

Comment 7 Jan Macku 2024-07-26 12:14:49 UTC
I think that the following change might be the root cause of your issue:

https://github.com/logrotate/logrotate/pull/560
https://github.com/logrotate/logrotate/commit/47f79e71b8e9f723b83081c3ddf74224f598610f

Change is included in logrotate-3.22.0

Comment 8 Alexey Tikhonov 2024-07-26 12:47:00 UTC
Jan,

(1) is logrotate service supposed to keep running all the time or is behavior mentioned in comment 4 - expected?

(2) do you think my proposal in comment 3 is a proper solution when log dir is non-root-group writable?

Comment 9 Jan Macku 2024-07-26 13:05:58 UTC
> (1) is logrotate service supposed to keep running all the time or is
> behavior mentioned in comment 4 - expected?

Rotation is based on the systemd timer. By default, it happens once per day.

> (2) do you think my proposal in comment 3 is a proper solution when log dir
> is non-root-group writable?

Yes, this should be the way to go. From the man page:

```
If the user/group you specify here does not have sufficient privilege to make files with the ownership you've specified in a create directive, it will cause an error.
If logrotate runs with root privileges, it is recommended to use the su directive to rotate files in directories that are directly or indirectly in control of non-privileged users.
```

Comment 10 Alexey Tikhonov 2024-07-26 13:12:30 UTC
(In reply to Jan Macku from comment #9)
> > (1) is logrotate service supposed to keep running all the time or is
> > behavior mentioned in comment 4 - expected?
> 
> Rotation is based on the systemd timer. By default, it happens once per day.
> 
> > (2) do you think my proposal in comment 3 is a proper solution when log dir
> > is non-root-group writable?
> 
> Yes, this should be the way to go. From the man page:


Thank you for the confirmation.

Comment 11 Alexey Tikhonov 2024-07-26 15:42:35 UTC
Upstream PR: https://github.com/SSSD/sssd/pull/7512

Comment 12 Alexey Tikhonov 2024-07-30 17:33:13 UTC
Pushed PR: https://github.com/SSSD/sssd/pull/7512

* `master`
    * e4ae4d6129e85fe99bbb82438ed90352400ecdf3 - BUILD: configure logrotate to work with non-root-group writable folder

Comment 13 Christian Stadelmann 2024-09-21 21:41:24 UTC
Any chance we can get an upstream release so we can get this fix in Fedora 41?

Comment 14 Alexey Tikhonov 2024-10-01 08:12:56 UTC
*** Bug 2315854 has been marked as a duplicate of this bug. ***

Comment 15 Jan Macku 2024-10-03 07:09:08 UTC
*** Bug 2316165 has been marked as a duplicate of this bug. ***

Comment 16 Timothée Ravier 2024-10-11 10:20:41 UTC
Gentle ping here. It would be great to get this in Fedora 41 before the freeze next week. Thanks

Comment 17 Fedora Update System 2024-10-15 12:36:16 UTC
FEDORA-2024-73827b9035 (sssd-2.10.0-1.fc41) has been submitted as an update to Fedora 41.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-73827b9035

Comment 18 Fedora Update System 2024-10-16 02:02:29 UTC
FEDORA-2024-73827b9035 has been pushed to the Fedora 41 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-73827b9035`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-73827b9035

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 19 Colin J Thomson 2024-10-16 17:13:24 UTC
I installed the update and logrotate.service now works fine here F41.. Karma left.

Comment 20 Fedora Update System 2024-10-17 23:11:45 UTC
FEDORA-2024-73827b9035 (sssd-2.10.0-1.fc41) has been pushed to the Fedora 41 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.