@@ -6,6 +6,7 @@
# without warranty of any kind.
/var/log/openvswitch/*.log {
+ su root root
daily
compress
sharedscripts
@@ -405,6 +405,7 @@ exit 0
%post
if [ $1 -eq 1 ]; then
sed -i 's:^#OVS_USER_ID=:OVS_USER_ID=:' /etc/sysconfig/openvswitch
+ sed -i 's:\(.*su\).*:\1 openvswitch openvswitch:' %{_sysconfdir}/logrotate.d/openvswitch
%if %{with dpdk}
sed -i \
@@ -414,6 +415,7 @@ if [ $1 -eq 1 ]; then
# In the case of upgrade, this is not needed.
chown -R openvswitch:openvswitch /etc/openvswitch
+ chown -R openvswitch:openvswitch /var/log/openvswitch
fi
%if 0%{?systemd_post:1}
@@ -601,7 +603,7 @@ fi
%endif
%doc NOTICE README.rst NEWS rhel/README.RHEL.rst
/var/lib/openvswitch
-%attr(750,openvswitch,openvswitch) /var/log/openvswitch
+%attr(750,root,root) /var/log/openvswitch
%ghost %attr(755,root,root) %{_rundir}/openvswitch
%files ovn-docker
The /var/log/openvswitch directory is owned by the openvswitch user but logrotate could be running as root or as another user. As a result of which, rpmlint prints the following warning when building the spec file on SUSE Linux Enterprise: openvswitch.x86_64: W: suse-logrotate-user-writable-log-dir /var/log/openvswitch openvswitch:openvswitch 0750 The log directory is writable by unprivileged users. Please fix the permissions so only root can write there or add the 'su' option to your logrotate config In order to fix that, we should run the logrotate script as the same user which runs the various Open vSwitch daemons. If this is a new installation, then this user is the 'openvswitch' one, but if we are upgrading from an older release, then the user is normally 'root'. As such, we set the initial user to 'root' and we fix this up in the %post scriptlet. Cc: Aaron Conole <aconole@redhat.com> Cc: Timothy Redaelli <tredaelli@redhat.com> Signed-off-by: Markos Chandras <mchandras@suse.de> --- rhel/etc_logrotate.d_openvswitch | 1 + rhel/openvswitch-fedora.spec.in | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-)