Logrotate complained to me this morning that it would not rotate some logs because their parent directory is writeable by someone else than root. The man page states I can make the error message go away by adding the "su" directive which makes logrotate drop root privileges when rotating that specific logfile. So far, so good.
What I wonder is (and the manpage is silent about it), how could a malicious user exploit logrotate if it would not take this precaution? As long as logrotate's configuration can only be altered by root (well, the configuration for logrotate that is triggered by cron and runs as root), an attacker cannot make logrotate touch arbitrary files, and I would assume logrotate does not touch symlinks?
