rsyslog $WorkDirectory should be explicitly set

Bug #918947 reported by Jamie Strandboge on 2012-01-19
This bug affects 1 person
Affects Status Importance Assigned to Milestone
rsyslog (Debian)
Fix Released
rsyslog (Ubuntu)
Jamie Strandboge
Jamie Strandboge

Bug Description

In testing the imfile functionality, I learned that when $WorkDirectory is not explicitly set, it defaults to '/'. This means that state files (and presumably other files) are written directly in /. This violates the FHS and is generally weird.

Granted, it appears that at least with imfile, the file is created then unlinked while keeping the fd open, I am not sure of the other uses of WorkDirectory. At a minimum, setting WorkDirectory allows us to adjust the AppArmor profile to have a reliable location.

Upstream documentation uses /var/spool/rsyslog, which seems like a sane default. Patch to achieve this is forthcoming.

Changed in rsyslog (Ubuntu):
assignee: nobody → Jamie Strandboge (jdstrand)
importance: Undecided → Medium
milestone: none → ubuntu-12.04-beta-1
status: New → Triaged
description: updated
Jamie Strandboge (jdstrand) wrote :

Attached is a patch that achieves this. I want to get input from Debian before uploading however, so please do not upload yet.

tags: added: patch
no longer affects: rsyslog
Changed in rsyslog (Debian):
status: Unknown → New
Martin Pitt (pitti) on 2012-03-02
Changed in rsyslog (Ubuntu):
milestone: ubuntu-12.04-beta-1 → ubuntu-12.04-beta-2
Jamie Strandboge (jdstrand) wrote :

Unmilestoning. I want to wait on Debian but don't want this to block anything on 12.04. I had hoped Debian would've responded by now, but oh well.

Changed in rsyslog (Ubuntu Precise):
milestone: ubuntu-12.04-beta-2 → none
Changed in rsyslog (Ubuntu Precise):
status: Triaged → In Progress
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package rsyslog - 5.8.6-1ubuntu7

rsyslog (5.8.6-1ubuntu7) precise; urgency=low

  * debian/rsyslog.conf: set $WorkDirectory to /var/spool/rsyslog, which is
    the example location in documentation. When not configured it defaults to
    '/', which is undesirable. (LP: #918947, Closes: #656535)
  * debian/rsyslog.dirs: add /var/spool/rsyslog/
  * debian/usr.sbin.rsyslogd:
    - adjust for $WorkDirectory
    - allow 'r' on /var/log/** too (for imfile)
 -- Jamie Strandboge <email address hidden> Wed, 07 Mar 2012 08:26:54 -0600

Changed in rsyslog (Ubuntu Precise):
status: In Progress → Fix Released
Changed in rsyslog (Debian):
status: New → Fix Released


Default $WorkDirectory /var/spool/rsyslog sould be chown to syslog:syslog in postinst.
As rsyslog drop privileges on startup by default on Ubuntu, the root:root default for /var/spool/rsyslog is useless.

Take me a lots of hours to figure it because rsyslog does not error out or warn in such cases.

Thank you.

To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.