NethVoice: asterisk full not rotated

[Stell0]

Steps to reproduce

• check asterisk full log in freepbx container

Expected behavior

• should be rotated like in older version

Actual behavior

• it is never rotated, gow till the container isn't restarted

See also

https://mattermost.nethesis.it/nethesis/pl/a7zuiyzexigmtrg1pwhfzqrngw

[Amygos]

Release nethesis/ns8-nethvoice 1.5.4

[Stell0]

Log rotation inside the freepbx container is not working because logrotate refuses to rotate logs whose parent directories have insecure permissions.

Example situation:

root@nethvoice:/var/lib/asterisk# ls -lah /var/log/asterisk/full
-rw-rw-r--. 1 asterisk asterisk 186M May  8 09:29 /var/log/asterisk/full

Running logrotate manually inside the container returns:

root@nethvoice:/var/lib/asterisk# logrotate /etc/logrotate.conf
error: skipping "/var/log/apache2/access.log" because parent directory has insecure permissions (It's world writable or writable by group which is not "root") Set "su" directive in config file to tell logrotate which user/group should be used for rotation.
error: skipping "/var/log/apache2/error.log" because parent directory has insecure permissions (It's world writable or writable by group which is not "root") Set "su" directive in config file to tell logrotate which user/group should be used for rotation.
error: skipping "/var/log/apache2/other_vhosts_access.log" because parent directory has insecure permissions (It's world writable or writable by group which is not "root") Set "su" directive in config file to tell logrotate which user/group should be used for rotation.
error: skipping "/var/log/asterisk/full" because parent directory has insecure permissions (It's world writable or writable by group which is not "root") Set "su" directive in config file to tell logrotate which user/group should be used for rotation.

Current permissions under /var/log:

drwxrwxrwx. 2 www-data www-data 72 Nov 15  2022 apache2
drwxrwxr-x. 1 asterisk asterisk 69 Apr  7 11:49 asterisk

Changing the permissions of /var/log/asterisk to 755 makes the rotation work:

root@nethvoice:/var/lib/asterisk# chmod 755 /var/log/asterisk/

After that, log rotation succeeds:

root@nethvoice:/var/lib/asterisk# ls -lah /var/log/asterisk/
total 15M
drwxr-xr-x. 1 asterisk asterisk  86 May  8 09:38 .
drwxr-xr-x. 1 root     root     156 May  1 00:17 ..
drwxrwxr-x. 1 asterisk asterisk   6 Apr  3 16:08 cdr-csv
drwxrwxr-x. 1 asterisk asterisk   6 Apr  3 16:08 cdr-custom
drwxrwxr-x. 1 asterisk asterisk   6 Apr  3 16:08 cel-custom
-rw-r-----. 1 asterisk asterisk 287 May  8 09:38 full
-rw-rw-r--. 1 asterisk asterisk 15M May  8 09:29 full.1.gz

The same problem likely affects /var/log/apache2 as well, since logrotate reports the same insecure parent directory error for Apache logs.

Possible fixes:

• adjust directory permissions, for example:

  • /var/log/asterisk should not be group-writable unless the group is root
  • /var/log/apache2 should not be world-writable

• or add the appropriate su directive in the related logrotate configuration files, so logrotate knows which user/group should be used for the rotation.

At minimum, /var/log/asterisk permissions should be fixed because the current mode prevents /var/log/asterisk/full from being rotated.

https://mattermost.nethesis.it/nethesis/pl/fw3hnwr5ntgqdfj1uejxer6izh