# logrotate doesn't honor file ACL **URL:** \ **Category:** SLES Configure-Administer\ **Created:** [October 30, 2013, 12:09pm UTC](https://forums.suse.com/t/logrotate-doesnt-honor-file-acl/24684 "2013-10-30T12:09:43Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![jdoeconsulting](https://avatars.discourse-cdn.com/v4/letter/j/f19dbf/32.png) [@jdoeconsulting](https://forums.suse.com/u/jdoeconsulting)\ **Post date:** [October 30, 2013, 12:09pm UTC](https://forums.suse.com/t/logrotate-doesnt-honor-file-acl/24684/1 "2013-10-30T12:09:43Z")
I’ve set an extended file acl, through setfacl, granting a user read rights to /var/log/messages This works like a charm. However every time the file is rotated through logrotate the extended file acl gets lost. In /etc/logrotate.d/syslog the following is defined; /var/log/warn /var/log/messages /var/log/allmessages /var/log/localmessages /var/log/firewall /var/log/acpid /var/log/NetworkManager { compress dateext maxage 365 rotate 99 missingok notifempty size +4096k create 640 root root sharedscripts postrotate /etc/init.d/syslog reload \> /dev/null endscript } This tells logrotate to create a new file with permissions 640 with owner root:root I’m guessing this is what causes the extended acl to be dropped. As far I know logrotate should keep the existing permissions of the file when creating the new one, or am I wrong? What needs to be done to keep the existing config for how /var/log/messages is rotated while keep the extended acl permission as well? Thanks ---
**Author:** ![smflood](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/smflood/32/10576_2.png) [@smflood](https://forums.suse.com/u/smflood)\ **Post date:** [October 30, 2013, 1:53pm UTC](https://forums.suse.com/t/logrotate-doesnt-honor-file-acl/24684/2 "2013-10-30T13:53:11Z")
On 30/10/2013 10:14, jdoeconsulting wrote: [color=blue] > I’ve set an extended file acl, through setfacl, granting a user read > rights > to /var/log/messages This works like a charm. > However every time the file is rotated through logrotate the extended > file > acl gets lost. > In /etc/logrotate.d/syslog the following is defined; > > /var/log/warn /var/log/messages /var/log/allmessages > /var/log/localmessages /var/log/firewall /var/log/acpid > /var/log/NetworkManager { > compress > dateext > maxage 365 > rotate 99 > missingok > notifempty > size +4096k > create 640 root root > sharedscripts > postrotate > /etc/init.d/syslog reload \> /dev/null > endscript > } > > This tells logrotate to create a new file with permissions 640 with > owner root:root > I’m guessing this is what causes the extended acl to be dropped. As far > I know logrotate > should keep the existing permissions of the file when creating the new > one, or am I wrong? > What needs to be done to keep the existing config for how > /var/log/messages is rotated while > keep the extended acl permission as well?[/color] Whilst you can use the logrotate “create” directive to set the mode, owner, and/or group of the new log file (see below) this doesn’t (re)set the ACLs. –begin– create mode owner group Immediately after rotation (before the postrotate script is run) the log file is created (with the same name as the log file just rotated). mode specifies the mode for the log file in octal (the same as chmod(2)), owner specifies the user name who will own the log file, and group specifies the group the log file will belong to. Any of the log file attributes may be omitted, in which case those attributes for the new file will use the same values as the original log file for the omitted attributes. This option can be disabled using the nocreate option. —end— What you can do instead (or as well) is use the “postrotate” directive to (re)set the ACLs –begin– postrotate/endscript The lines between postrotate and endscript (both of which must appear on lines by themselves) are executed (using /bin/sh) after the log file is rotated. These directives may only appear inside a log file definition. Normally, the absolute path to the log file is passed as first argument to the script. If shared- scripts is specified, whole pattern is passed to the script. See also prerotate. See sharedscripts and nosharedscripts for error handling. —end— So for the example you gave, add your setfacl command(s) above the “endscript” directive which will give you something like –begin– /var/log/warn /var/log/messages /var/log/allmessages /var/log/localmessages /var/log/firewall /var/log/acpid /var/log/NetworkManager { compress dateext maxage 365 rotate 99 missingok notifempty size +4096k create 640 root root sharedscripts postrotate /etc/init.d/syslog reload \> /dev/null /path/to/setfacl … endscript } —end— ## HTH. Simon SUSE Knowledge Partner * * * ## If you find this post helpful and are logged into the web interface, please show your appreciation and click on the star below. Thanks. ---
**Author:** ![ab1](https://avatars.discourse-cdn.com/v4/letter/a/d2c977/32.png) [@ab1](https://forums.suse.com/u/ab1)\ **Post date:** [October 30, 2013, 3:07pm UTC](https://forums.suse.com/t/logrotate-doesnt-honor-file-acl/24684/3 "2013-10-30T15:07:44Z")
Looks like this may be fixed in newer code too, give or take in logrotate 3.7.9. It may be worth trying in case these changes have been backported into the latest version that SLES ships, though I do not see it in the changelog on my SLES 11 SP3 system currently: [http://svn.fedorahosted.org/svn/logrotate/tags/r3-8-7/CHANGES](http://svn.fedorahosted.org/svn/logrotate/tags/r3-8-7/CHANGES) – Good luck. If you find this post helpful and are logged into the web interface, show your appreciation and click on the star below… ---
**Author:** ![jdoeconsulting](https://avatars.discourse-cdn.com/v4/letter/j/f19dbf/32.png) [@jdoeconsulting](https://forums.suse.com/u/jdoeconsulting)\ **Post date:** [October 30, 2013, 4:07pm UTC](https://forums.suse.com/t/logrotate-doesnt-honor-file-acl/24684/4 "2013-10-30T16:07:26Z")
Thanks Simon, I thought about going that route to reset the ACL in the postrotate script. But just as ab points out I noticed when searching on this one that there was a bug report for this issue in the Red Hat bugzilla. Just as ab notes it seems the fix is not yet in the SLES distro so SLES have the same issue. I’ll go with the postrotate script to fix the issue at hand. Thanks ---
**Author:** ![jdoeconsulting](https://avatars.discourse-cdn.com/v4/letter/j/f19dbf/32.png) [@jdoeconsulting](https://forums.suse.com/u/jdoeconsulting)\ **Post date:** [October 30, 2013, 4:09pm UTC](https://forums.suse.com/t/logrotate-doesnt-honor-file-acl/24684/5 "2013-10-30T16:09:05Z")
Yes I noticed that. I’ll use the postrotate script to fix the issue at hand. Thanks! ---
**Author:** ![smflood](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/smflood/32/10576_2.png) [@smflood](https://forums.suse.com/u/smflood)\ **Post date:** [October 30, 2013, 4:56pm UTC](https://forums.suse.com/t/logrotate-doesnt-honor-file-acl/24684/6 "2013-10-30T16:56:27Z")
On 30/10/2013 14:14, jdoeconsulting wrote: [color=blue] > I thought about going that route to reset the ACL in the postrotate > script. > But just as ab points out I noticed when searching on this one that > there > was a bug report for this issue in the Red Hat bugzilla. > Just as ab notes it seems the fix is not yet in the SLES distro so SLES > have the same issue.[/color] You didn’t say which version of SLES you’re using but checking packages and updates for SLES11 SP1-SP3 it seems the version of logrotate SUSE are using is version 3.7.7 with some security fixes backported. ## HTH. Simon SUSE Knowledge Partner * * * ## If you find this post helpful and are logged into the web interface, please show your appreciation and click on the star below. Thanks. ---
**Author:** ![jdoeconsulting](https://avatars.discourse-cdn.com/v4/letter/j/f19dbf/32.png) [@jdoeconsulting](https://forums.suse.com/u/jdoeconsulting)\ **Post date:** [October 31, 2013, 10:34am UTC](https://forums.suse.com/t/logrotate-doesnt-honor-file-acl/24684/7 "2013-10-31T10:34:00Z")
Simon, I’m sorry I missed informing you that I was running with SLES 11 SP2. Anyhow I’ve implemented the fix by using the postrotate script to run the setfacl command and it works just fine. Thanks! ---
**Author:** ![smflood](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/smflood/32/10576_2.png) [@smflood](https://forums.suse.com/u/smflood)\ **Post date:** [October 31, 2013, 12:58pm UTC](https://forums.suse.com/t/logrotate-doesnt-honor-file-acl/24684/8 "2013-10-31T12:58:54Z")
On 31/10/2013 08:34, jdoeconsulting wrote: [color=blue] > I’m sorry I missed informing you that I was running with SLES 11 SP2.[/color] No problem. In this case it doesn’t seem to make a difference (SLES11 SPx = logrotate 3.7.7) but most of the time it’s important to note. [color=blue] > Anyhow I’ve implemented the fix by using the postrotate script to run > the setfacl command and it works just fine.[/color] ## That’s good to hear, thanks for the report back. Simon SUSE Knowledge Partner * * * ## If you find this post helpful and are logged into the web interface, please show your appreciation and click on the star below. Thanks.