Apache 2.4 log question

Question

Documentation for Apache 2.4 states that:

Anyone who can write to the directory where Apache httpd is writing a log file can almost certainly gain access to the uid that the server is started as, which is normally root.

By "the directory where Apache httpd is writing a log file" I assume that they mean the /var/log/httpd directory. On my machine this directory can only be accessed by the root user (I have to "sudo su" to enter that directory).

Does this mean that a security issue would result if I were to chmod /var/log/httpd to 777? It looks from the documentation that the answer is yes. But I would like to understand better why that is the case.

How can granting access to the Apache log directory to a non-root user allow that user to gain root access?

---

Edit: Poking around a little more on the Apache "security tips" page I found this further explanation:

If the logs directory is writeable (by a non-root user), someone could replace a log file with a symlink to some other system file, and then root might overwrite that file with arbitrary data. If the log files themselves are writeable (by a non-root user), then someone may be able to overwrite the log itself with bogus data.

This explains a little bit more as to why one would not want the directory writable or the files in the directory writable by arbitrary user. I still don't think this addresses exactly how:

Anyone who can write to the directory where Apache httpd is writing a log file can almost certainly gain access to [root]

Answer 1

How can granting access to the Apache log directory to a non-root user allow that user to gain root access?

It is not saying non-root user can perform any kind of direct privilege escalation as a result of this, what it is saying is the log dir should be restricted as there is potential to perform a PE.

Apache is spawned by the root process (needed to bind to port 80) so the logging dir is owned by root. You could theoretically use a public or non-root owned log file as a potential avenue for privilege escalation, e.g non-root user writing files that root would consume, but their are a number of steps needed to do this.

The Apache logs, like any other kind of logs will contain all sorts of juicy information that you definitely do not want to be public.

Does this mean that a security issue would result if I were to chmod /var/log/httpd to 777?

Yes. For the reasons mentioned above.

I have no idea what kind of logs you are creating, their are options around all of this (custom log dirs, new users/groups etc) but it all depends on context.

Definitely do not make them public.