#1014732 logrotate: daily mail “error: state file /var/lib/logrotate/status is world-readable and thus…”

Package:
logrotate
Source:
logrotate
Description:
Log rotation utility
Submitter:
Thorsten Glaser
Date:
2024-01-04 18:45:03 UTC
Severity:
normal
Tags:
#1014732#5
Date:
2022-07-10 22:27:15 UTC
From:
To:
I got a new version of logrotate on multiple systems due to the
security/point release, and since then I get, every night, from
all of them, this:

│Subject: Anacron job 'cron.daily' on $hostname
│
│/etc/cron.daily/logrotate:
│error: state file /var/lib/logrotate/status is world-readable and thus can be locked from other unprivileged
│users. Skipping lock acquisition...

This is new and very annoying.

And wrong:

$ lo /var/lib/logrotate/
total 12
drwxr-xr-x  2 root root 4096 10. Jul 07:55 ./
drwxr-xr-x 80 root root 4096 10. Jun 00:01 ../
-rw-r-----  1 root root 2952 10. Jul 07:55 status

(At least it is wrong now; no idea if it is also wrong during
that cronjob’s run.)

It should be noted I have both cron and anacron installed, in
case that matters.

#1014732#10
Date:
2022-07-11 05:30:12 UTC
From:
To:
Can confirm this bug here, and an updated patch fixes this.

See:

https://bugzilla.redhat.com/show_bug.cgi?id=2090926

And:

https://github.com/logrotate/logrotate/commit/31cf1099ab8514dfcae5a980bc77352edd5292f8


Suggest at the very least, this is updated in Debian for the next point
release.  This is a very misleading error message as it stands.  Very.

#1014732#19
Date:
2022-07-14 07:53:34 UTC
From:
To:
I observe the same behavior.

Since there seems updated package being availabe, I apparently need to fix the logrotate script myself to not get mail each other day from multiple dozens of machines…

:wq! PoC

#1014732#24
Date:
2022-08-06 03:23:13 UTC
From:
To:
Dixi quod…

After a while, I can now say it’s only once for every system,
but I had upgraded several in waves and over nights, so the
eMails spread out enough for me to think it was occurring for
every system every night.

I guess someone forgot a chmod in postinst or something. The
proposed patch is certainly overkill if not even wrong.

bye,
//mirabilos