logrotate fails with "error: Ignoring nginx-agent because it is writable by group or others"

[agt-the-walker]

Bug Overview

When "logrotate" runs (through systemd timer or manually), it doesn't take into account /etc/logrotate.d/nginx-agent because its permissions are 0664 (i.e. group-writable).

Expected Behavior

/etc/logrotate.d/nginx-agent should be 0644 instead.

Steps to Reproduce the Bug

$ sudo systemctl status logrotate | grep -w error
Jun 01 00:00:01 redacted.unil.ch logrotate[1988721]: error: Ignoring nginx-agent because it is writable by group or others.

$ sudo logrotate /etc/logrotate.conf
error: Ignoring nginx-agent because it is writable by group or others.

$ ls -l /etc/logrotate.d/nginx-agent
-rw-rw-r--. 1 root root 554 Mar 26 12:05 /etc/logrotate.d/nginx-agent

$ rpm -qf /etc/logrotate.d/nginx-agent
nginx-agent-2.46.1-1.x86_64

$ rpm -q --queryformat="[%{FILEMODES:perms} %{FILENAMES}\n]" nginx-agent | fgrep -w logrotate.d
-rw-rw-r-- /etc/logrotate.d/nginx-agent

Environment Details

• Target deployment platform: local cluster
• Target OS: RHEL 9.8
• Version of this project or specific commit: nginx-agent-2.46.1-1.x86_64 RPM package
• "logrotate" RPM packages: logrotate-3.18.0-12.el9.x86_64, rsyslog-logrotate-8.2510.0-2.el9.x86_64

Additional Context

Other files in /etc/logrotate.d/ on my RHEL 9 systems all have 0644 permission.

Thanks for your time. More details upon request.