From 0caff0a074445b8a10050e336fdf9de3b11a6150 Mon Sep 17 00:00:00 2001 From: Alexey Gladkov Date: Sat, 25 Apr 2020 18:01:50 +0300 Subject: ALT: insecure permissions Signed-off-by: Alexey Gladkov --- logrotate.c | 36 ++++++++++++++++++++++++++++++------ 1 file changed, 30 insertions(+), 6 deletions(-) diff --git a/logrotate.c b/logrotate.c index 27a864a..24cce46 100644 --- a/logrotate.c +++ b/logrotate.c @@ -1376,13 +1376,37 @@ static int findNeedRotating(const struct logInfo *log, unsigned logNum, int forc free(logpath); return 0; } - /* Don't rotate in directories writable by others or group which is not "root" */ - if ((sb.st_gid != 0 && (sb.st_mode & S_IWGRP)) || (sb.st_mode & S_IWOTH)) { - message(MESS_ERROR, "skipping \"%s\" because parent directory has insecure permissions" - " (It's world writable or writable by group which is not \"root\")" - " Set \"su\" directive in config file to tell logrotate which user/group" + /* Don't rotate in insecure directories. */ + if (sb.st_uid != 0) { + message(MESS_ERROR, "skipping \"%s\" because parent" + " directory has insecure permissions" + " (it's not owned by \"root\");" + " consider using \"su\" directive in config" + " file to tell logrotate which user/group" " should be used for rotation.\n" - ,log->files[logNum]); + , log->files[logNum]); + free(logpath); + return 1; + } + if (sb.st_mode & S_IWGRP && !(sb.st_mode & S_ISVTX)) { + message(MESS_ERROR, "skipping \"%s\" because parent" + " directory has insecure permissions" + " (it's group writable and has no sticky bit set);" + " consider using \"su\" directive in config" + " file to tell logrotate which user/group" + " should be used for rotation.\n" + , log->files[logNum]); + free(logpath); + return 1; + } + if (sb.st_mode & S_IWOTH) { + message(MESS_ERROR, "skipping \"%s\" because parent" + " directory has insecure permissions" + " (it's writable by others);" + " consider using \"su\" directive in config" + " file to tell logrotate which user/group" + " should be used for rotation.\n" + , log->files[logNum]); free(logpath); return 1; } -- 2.25.4