logrotate read only filesystem problem

I recently configured OpenResty's logrotate rule, but encountered a strange problem. It is ok to execute it directly on the command line, but it is not possible to execute it on the systemd timer.

The reasons are as follows:

In the systemd service file, file read and write protection is added to logrotate:

[Unit]
Description=Rotate log files
Documentation=man:logrotate(8) man:logrotate.conf(5)                
ConditionACPower=true

[Service]
Type=oneshot
ExecStart=/usr/sbin/logrotate /etc/logrotate.conf                   

# performance options
Nice=19
IOSchedulingClass=best-effort
IOSchedulingPriority=7

# hardening options
#  details: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
#  no ProtectHome for userdir logs                                  
#  no PrivateNetwork for mail deliviery                             
#  no ProtectKernelTunables for working SELinux with systemd older than 235
#  no MemoryDenyWriteExecute for gzip on i686                       
PrivateDevices=true
PrivateTmp=true
ProtectControlGroups=true
ProtectKernelModules=true
ProtectSystem=full
RestrictRealtime=true

reason¶

The problem lies in ProtectSystem=full. Check the link above and find the following description:

ProtectSystem=
Takes a boolean argument or the special values "full" or "strict". If true, mounts the /usr/ and the boot loader
directories (/boot and /efi) read-only for processes invoked by this unit. If set to "full", the /etc/ directory
is mounted read-only, too. If set to "strict" the entire file system hierarchy is mounted read-only, except for
the API file system subtrees /dev/, /proc/ and /sys/ (protect these directories using PrivateDevices=,
ProtectKernelTunables=, ProtectControlGroups=). This setting ensures that any modification of the vendor-supplied
operating system (and optionally its configuration, and local mounts) is prohibited for the service. It is
recommended to enable this setting for all long-running services, unless they are involved with system updates
or need to modify the operating system in other ways. If this option is used, ReadWritePaths= may be used to
exclude specific directories from being made read-only. This setting is implied if DynamicUser= is set.
This setting cannot ensure protection in all cases. In general it has the same limitations as ReadOnlyPaths=,
see below. Defaults to off.

If ProtectSystem=full then /usr/, /boot, /efi, /etc will be mounted as read-only, if ProtectSystem=strict, then the entire file system will be mounted as read-only.

However, OpenResty happened to be installed under /usr/local/openresty, which is a coincidence.

So, add a line at the end of /lib/systemd/system/logrotate.service and change it to this:

[Unit]
Description=Rotate log files
Documentation=man:logrotate(8) man:logrotate.conf(5)
ConditionACPower=true

[Service]
Type=oneshot
ExecStart=/usr/sbin/logrotate /etc/logrotate.conf

# performance options
Nice=19
IOSchedulingClass=best-effort
IOSchedulingPriority=7

# hardening options
#  details: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
#  no ProtectHome for userdir logs
#  no PrivateNetwork for mail deliviery
#  no ProtectKernelTunables for working SELinux with systemd older than 235
#  no MemoryDenyWriteExecute for gzip on i686
PrivateDevices=true
PrivateTmp=true
ProtectControlGroups=true
ProtectKernelModules=true
ProtectSystem=full
RestrictRealtime=true
ReadWritePaths=/usr/local/openresty/nginx/logs

systemctl daemon-reload && systemctl restart logrotate 

over!