Abusing write permission on Apache logs dir to escalete privileges

Question

I have just come across this sentence on apache log files documentation:

Anyone who can write to the directory where Apache is writing a log file can almost certainly gain access to the uid that the server is started as, which is normally root. Do NOT give people write access to the directory the logs are stored in without being aware of the consequences; see the security tips document for details.

How can someone abuse that as a privilege escalation?

Answer 1

Directly from the docs, "see the security tips document for details"

If the logs directory is writeable (by a non-root user), someone could replace a log file with a symlink to some other system file, and then root might overwrite that file with arbitrary data. If the log files themselves are writeable (by a non-root user), then someone may be able to overwrite the log itself with bogus data.