[/var/run, /var/spool/lock]

To accomplish this newsyslog(8) becomes suid root, with the euid being set
to ruid when the elevated privs are not needed...