Red Hat Bugzilla – Bug 4825
logrotate doesn't quote shell constructs in filenames
Last modified: 2008-05-01 11:37:51 EDT
I got the following mail:
From: root <root>
Subject: errors rotating logs
errors occured while rotating /home/carlo/irc/log/*
such file or directory
sh: Neo: command not found
sh: .1: command not found
failed to compress previous log
Note that "log.Flanders.Be.Eu.Undernet.org.|Neo|" is a
FILE name. It tries (as root) to execute `Neo'. Surely
some quoting is missing somewhere :)
well I would hardly call this "arbitrary commands." I can't see how a
user would be able to exploit this. If root is logrotating logs, then
he has control over which directories and files to rotate. If you are
running it as a user, you do as well.
However, you are correct that it isn't quoting everything (at least
that is how things appear). I'll look into that.
it will be difficult to change logrotate to not do this. Please
rename your log file.