Different user or group for fpm causes logrotate issues on CentOS

Affected Puppet, Ruby, OS and module versions/distributions

• Puppet: 5
• Ruby: N/A
• Distribution: CentOS
• Module version: 5.0.2

How to reproduce

Use the following settings:

php::fpm: true
php::fpm_user: 'wwwrun'
php::fpm_group: 'automation'

Then trigger logrotation.

What are you seeing

Logrotate gives the following error message:

/etc/cron.daily/logrotate:

error: skipping "/var/log/php-fpm/error.log" because parent directory has insecure permissions (It's world writable or writable by group which is not "root") Set "su" directive in config file to tell logrotate which user/group should be used for rotation.

Access on /var/log/php-fpm is set by this puppet module. With the above settings it is:

drwxrwx--- 2 wwwrun automation 136 Nov 1 08:48 php-fpm

The error and log files inside of it are owned by user and group root, and the master process is also running as root. Maybe that directory should simply have root:root as user and group? That would resolve this issue.

Process:
root 15909 0.0 0.4 479696 31452 ? Ss Oct10 1:10 php-fpm: master process (/etc/php-fpm.conf)

Log files in /var/log/php-fpm/:

-rw------- 1 root root 2006357 Nov  1 09:13 error.log
-rw------- 1 root root   41279 Sep  2 02:02 error.log-20180902.gz
-rw------- 1 root root   40629 Sep  9 05:11 error.log-20180909.gz
-rw------- 1 root root   43034 Sep 16 00:48 error.log-20180916.gz
-rw------- 1 root root  355111 Sep 23 03:08 error.log-20180923

What behaviour did you expect instead

No error messages at logrotation time because of what this module does.

Any additional information you'd like to impart

Piece of puppet code causing this issue is in manifests/fpm/config.pp

  ensure_resource('file', ['/var/run/php-fpm/', '/var/log/php-fpm/'], {
    ensure => directory,
    owner => $user,
    group => $group,
  })

Start in manifests/fpm/config.pp, focusing on how /var/log/php-fpm/ is created with the configured FPM user and group. Reproduce with fpm_user set to wwwrun and fpm_group set to automation, then trigger logrotate on CentOS. Done means logrotate no longer reports insecure parent-directory permissions for the PHP-FPM logs.