Hiya, I got the following mail: From: root <root> To: carlo.nl Subject: errors rotating logs errors occured while rotating /home/carlo/irc/log/* /home/carlo/irc/log/log.Flanders.Be.Eu.Undernet.org.: No such file or directory sh: Neo: command not found sh: .1: command not found failed to compress previous log /home/carlo/irc/log/log.Flanders.Be.Eu.Undernet.org.|Neo|.1 Note that "log.Flanders.Be.Eu.Undernet.org.|Neo|" is a FILE name. It tries (as root) to execute `Neo'. Surely some quoting is missing somewhere :) Greetings, Carlo Wood
well I would hardly call this "arbitrary commands." I can't see how a user would be able to exploit this. If root is logrotating logs, then he has control over which directories and files to rotate. If you are running it as a user, you do as well. However, you are correct that it isn't quoting everything (at least that is how things appear). I'll look into that.
it will be difficult to change logrotate to not do this. Please rename your log file.