Documentation for Apache 2.4 states that:
Anyone who can write to the directory where Apache httpd is writing a log file can almost certainly gain access to the uid that the server is started as, which is normally root.
By "the directory where Apache httpd is writing a log file" I assume that they mean the /var/log/httpd directory. On my machine this directory can only be accessed by the root user (I have to "sudo su" to enter that directory).
Does this mean that a security issue would result if I were to chmod /var/log/httpd to 777? It looks from the documentation that the answer is yes. But I would like to understand better why that is the case.
How can granting access to the Apache log directory to a non-root user allow that user to gain root access?
Edit: Poking around a little more on the Apache "security tips" page I found this further explanation:
If the logs directory is writeable (by a non-root user), someone could replace a log file with a symlink to some other system file, and then root might overwrite that file with arbitrary data. If the log files themselves are writeable (by a non-root user), then someone may be able to overwrite the log itself with bogus data.
This explains a little bit more as to why one would not want the directory writable or the files in the directory writable by arbitrary user. I still don't think this addresses exactly how:
Anyone who can write to the directory where Apache httpd is writing a log file can almost certainly gain access to [root]