RHBA-2013:1095 - Bug Fix Advisory

Topic

Updated logrotate packages that fix several bugs are now available for Red Hat
Enterprise Linux 6.

Description

The logrotate utility simplifies the administration of multiple log files,
allowing the automatic rotation, compression, removal, and mailing of log files.

This update fixes the following bugs:

• The logrotate utility always tried to set owner of the rotated log even when

the owner was the same as the current owner of the log file. Conseqeuntly, the
rotation failed on file systems or systems where changing the ownership was not
supported. With this update, before the ownership is changed, logrotate check if
it is a real ownership change; that is, logrotate verifies if the new ownership
is not the same as the previous one, and skips the change if the ownership
change has not been real. The logrotate utility now rotates logs as expected in
this scenario. (BZ#841520)

• Setting the Access control list (ACL) on a rotated log overwrote the

previously set mode of the log file. As a consequence, the "create" directive
was ignored. To fix this bug, the ACL is no longer copied from the old log file
when using the "create" directive and the mode defined using the "create"
directive is used instead. As a result, "create" mode works as expected and it
is no longer ignored in the described scenario. (BZ#847338)

• Both the acl_set_fd() and fchmod() functions were called to set the log files

permissions. Consequently, there was a race condition where the log file could
have unsafe permissions for a short time during its creation. With this update,
only one of those functions is now called depending on directives combination
used in the configuration file and race condition between the acl_set_fd() and
fchmod() function is not possible in the described scenario. (BZ#847339)

• Because the inverse umask value 0000 was used when creating a new log file,

the newly created log file could have unwanted 0600 permissions for a short time
before the permissions were set to the proper value using the fchmod() function.
With this update, umask is set to 0777 and the newly created log file has proper
0000 permissions for this short period. (BZ#848131)

• The default SELinux context was set after the compressed log file had been

created. Consequently, the compressed log did not have the proper SELinux
context. With this update, the default SELinux context is now set before the
compressed log file creation and compressed log files have proper SELinux
context. (BZ#920030)

• Temporary files created by the logrotate utility were not removed if an error

occurred during its use. With this update, temporary files are now removed in
such a case. (BZ#922169)

Users of logrotate are advised to upgrade to these updated packages, which fix
these bugs.

Solution

Before applying this update, make sure all previously-released errata relevant
to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red
Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 841520 - logrotate is unable to compress log files on NFS mounted directory
• BZ - 847338 - logrotate ignores create mode
• BZ - 847339 - logrotate ACL fix race condition
• BZ - 848131 - logrotate uses inverse umask

CVEs

(none)

References

(none)