Bug 751581 - Logrotate complaining about mailman insecure directories, refuses to rotate logs
Summary: Logrotate complaining about mailman insecure directories, refuses to rotate logs
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: mailman
Version: 16
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Jan Kaluža
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-11-05 22:08 UTC by Bojan Smojver
Modified: 2011-12-14 23:34 UTC (History)
3 users (show)

Fixed In Version: mailman-2.1.14-12.fc16
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-12-14 23:34:58 UTC
Type: ---


Attachments (Terms of Use)

Description Bojan Smojver 2011-11-05 22:08:21 UTC
Description of problem:

error: skipping "/var/log/mailman/bounce" because parent directory has insecure permissions (It's world writable or writable by group which is not "root") Set "su" directive in config file to tell logrotate which user/group should be used for rotation.

And same for all other files /etc/logrotate.d/mailman

Version-Release number of selected component (if applicable):
mailman-2.1.14-9.fc16.x86_64

How reproducible:
Always.

Steps to Reproduce:
1. Enable log rotation.
2. See output.
  
Actual results:
Doesn't rotate logs.

Expected results:
Worked find in F-15.

Additional info:

Comment 1 Fedora Update System 2011-11-07 09:22:27 UTC
mailman-2.1.14-10.fc16 has been submitted as an update for Fedora 16.
https://admin.fedoraproject.org/updates/mailman-2.1.14-10.fc16

Comment 2 Fedora Update System 2011-11-10 17:44:57 UTC
Package mailman-2.1.14-10.fc16:
* should fix your issue,
* was pushed to the Fedora 16 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing mailman-2.1.14-10.fc16'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2011-15676
then log in and leave karma (feedback).

Comment 3 Bojan Smojver 2011-11-12 09:22:26 UTC
Much better, but still getting:

error: error setting owner of /var/log/mailman/error: Operation not permitted

Comment 4 Jan Kaluža 2011-11-14 09:26:30 UTC
Hm, can you please send me output of "ls -l /var/log/mailman"?

Comment 5 Jan Kaluža 2011-11-14 09:30:36 UTC
Ah, you don't have to. I know what's bad. I'll push another fix soon.

Comment 6 Bojan Smojver 2011-11-21 21:36:30 UTC
Something is still not right here. Now I'm having mailmain throw an error when I access its web interface. Shouldn't the files there be owned by apache:mailman or something?

Comment 7 Bojan Smojver 2011-11-21 22:05:56 UTC
(In reply to comment #6)
> Something is still not right here. Now I'm having mailmain throw an error when
> I access its web interface. Shouldn't the files there be owned by
> apache:mailman or something?

Sorry, wasn't clear there. /var/log/mailman/error was owned by mailman:mailman (-10 version of the rpm) with 0600 permissions. This prevented Apache from opening the file:
--------------
[Tue Nov 22 08:10:57 2011] [error] [client <IP>] IOError: [Errno 13] Permission denied: '/var/log/mailman/error'
--------------

I changed the ownership of that file to apache by hand now, but not sure what it's supposed to be. Apache user is not part of mailman group on my machine - maybe it should be?

Comment 8 Trevor Cordes 2011-11-29 14:03:08 UTC
"Me too".

Apache isn't a member of mailman group here.  I don't think it should be.  That opens up too many security issues.

Comment 9 Jan Kaluža 2011-12-01 07:15:02 UTC
I've finally updated to F16, so, hopefully, I'll be able to reproduce it.

Comment 10 Fedora Update System 2011-12-01 10:42:56 UTC
mailman-2.1.14-12.fc16 has been submitted as an update for Fedora 16.
https://admin.fedoraproject.org/updates/mailman-2.1.14-12.fc16

Comment 11 Jan Kaluža 2011-12-01 10:46:45 UTC
Please try this update. It should fix the problem when httpd can't write to /var/log/mailman/error. If it won't work, please paste output of "ls -l /var/log/mailman" and "ls -l /var/log|grep mailman" here.

Comment 12 Bojan Smojver 2011-12-01 20:37:46 UTC
(In reply to comment #11)
> Please try this update. It should fix the problem when httpd can't write to
> /var/log/mailman/error. If it won't work, please paste output of "ls -l
> /var/log/mailman" and "ls -l /var/log|grep mailman" here.

OK, thank you. Will do and will let you know it went.

Comment 13 Fedora Update System 2011-12-04 02:45:22 UTC
Package mailman-2.1.14-12.fc16:
* should fix your issue,
* was pushed to the Fedora 16 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing mailman-2.1.14-12.fc16'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2011-16739/mailman-2.1.14-12.fc16
then log in and leave karma (feedback).

Comment 14 Trevor Cordes 2011-12-14 10:44:12 UTC
Worked for me.  No more warnings.

Comment 15 Jan Kaluža 2011-12-14 10:46:28 UTC
Ok, pushing it to F16

Comment 16 Bojan Smojver 2011-12-14 11:30:47 UTC
I haven't seen any warnings with the latest package either. Mailman seems to work fine too.

Comment 17 Jonathan Baron 2011-12-14 20:13:44 UTC
I am seeing the original problem with
mailman-2.1.14-9.fc16.i686
logrotate-3.8.0-3.fc16.i686
httpd-2.2.21-1.fc16.i686
(all the latest for Fedora 16)

The output from logrotate has lots of these:
error: skipping "/var/log/mailman/bounce" because parent directory has insecure
permissions (It's world writable or writable by group which is not "root") Set "su"
directive in config file to tell logrotate which user/group should be used for
rotation.

The logs themselves (I think) look like this:
-rw-rw-r--   1 mailman mailman   6260 Dec 14 07:44 vette
-rw-rw-r--   1 mailman mailman    987 Dec 14 07:46 post
-rw-rw-r--   1 mailman mailman   2188 Dec 14 12:05 subscribe
-rw-rw-r--   1 mailman mailman  21545 Dec 14 12:17 smtp
-rw-rw-r--   1 mailman mailman   8262 Dec 14 12:32 bounce

And the directory that holds them, /var/log/mailman (I think) like this:
drwxrwsr-x. 2 root  mailman     4096 Jul 14 05:31 mailman/

Before I upgraded on Dec. 12 to Fedora 16, the logs were apparently getting rotated regularly, as I have a whole bunch of them with numbers after them, like 
-rw-rw-r--   1 mailman mailman   2580 Dec  9 10:47 vette-20111211

Mailman works fine, but these logs are not getting rotated.

I suppose it might help if I changed their ownership to root:mailman, but I should not have to do that (even if it works).

Comment 18 Fedora Update System 2011-12-14 23:34:58 UTC
mailman-2.1.14-12.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.