Ubuntu
rsyslog package

rsyslog $WorkDirectory should be explicitly set

Bug #918947 reported by Jamie Strandboge
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
rsyslog (Debian)
Fix Released
Unknown
rsyslog (Ubuntu)
Fix Released
Medium
Jamie Strandboge
Precise
Fix Released
Medium
Jamie Strandboge

Bug Description

In testing the imfile functionality, I learned that when $WorkDirectory is not explicitly set, it defaults to '/'. This means that state files (and presumably other files) are written directly in /. This violates the FHS and is generally weird.

Granted, it appears that at least with imfile, the file is created then unlinked while keeping the fd open, I am not sure of the other uses of WorkDirectory. At a minimum, setting WorkDirectory allows us to adjust the AppArmor profile to have a reliable location.

Upstream documentation uses /var/spool/rsyslog, which seems like a sane default. Patch to achieve this is forthcoming.

See original description
Tags: patch
Jamie Strandboge (jdstrand)
Changed in rsyslog (Ubuntu):
assignee: nobody → Jamie Strandboge (jdstrand)
importance: Undecided → Medium
milestone: none → ubuntu-12.04-beta-1
status: New → Triaged
Jamie Strandboge (jdstrand)
description: updated
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Attached is a patch that achieves this. I want to get input from Debian before uploading however, so please do not upload yet.

Ubuntu Foundations Team Bug Bot (crichton)
tags: added: patch
Jamie Strandboge (jdstrand)
no longer affects: rsyslog
Bug Watch Updater (bug-watch-updater)
Changed in rsyslog (Debian):
status: Unknown → New
Martin Pitt (pitti)
Changed in rsyslog (Ubuntu):
milestone: ubuntu-12.04-beta-1 → ubuntu-12.04-beta-2
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Unmilestoning. I want to wait on Debian but don't want this to block anything on 12.04. I had hoped Debian would've responded by now, but oh well.

Changed in rsyslog (Ubuntu Precise):
milestone: ubuntu-12.04-beta-2 → none
Jamie Strandboge (jdstrand)
Changed in rsyslog (Ubuntu Precise):
status: Triaged → In Progress
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package rsyslog - 5.8.6-1ubuntu7

---------------
rsyslog (5.8.6-1ubuntu7) precise; urgency=low

  * debian/rsyslog.conf: set $WorkDirectory to /var/spool/rsyslog, which is
    the example location in documentation. When not configured it defaults to
    '/', which is undesirable. (LP: #918947, Closes: #656535)
  * debian/rsyslog.dirs: add /var/spool/rsyslog/
  * debian/usr.sbin.rsyslogd:
    - adjust for $WorkDirectory
    - allow 'r' on /var/log/** too (for imfile)
 -- Jamie Strandboge <email address hidden> Wed, 07 Mar 2012 08:26:54 -0600

Changed in rsyslog (Ubuntu Precise):
status: In Progress → Fix Released
Bug Watch Updater (bug-watch-updater)
Changed in rsyslog (Debian):
status: New → Fix Released
Revision history for this message
Emmanuel Fusté (emmanuel-fuste-thalesgroup) wrote :

Hello,

Default $WorkDirectory /var/spool/rsyslog sould be chown to syslog:syslog in postinst.
As rsyslog drop privileges on startup by default on Ubuntu, the root:root default for /var/spool/rsyslog is useless.

Take me a lots of hours to figure it because rsyslog does not error out or warn in such cases.

Thank you.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.