New subject: Freeze Break Request - selinux policy for mirrorlist containers to allow logrotate to work.

2 Jul 2017

Greetings.
Currently our mirrorlist containers on proxies aren't getting their logs rotated due to selinux policy. This patch hopefully fixes that and allows them to be rotated.
I have tested this on proxy01.stg and it seems to work there now.
+1s?
--
From 7b0ebec7dbc1085977a727298648516c7198555e Mon Sep 17 00:00:00 2001
From: Kevin Fenzi kevin@scrye.com
Date: Sun, 2 Jul 2017 18:45:49 +0000
Subject: [PATCH] initial selinux policy to allow logrotate to rotate
 mirrorlist container log files
Signed-off-by: Kevin Fenzi kevin@scrye.com
---
 .../files/selinux/mirrorlist-logrotate.mod         | Bin 0 -> 1204 bytes
 .../files/selinux/mirrorlist-logrotate.pp          | Bin 0 -> 1220 bytes
 .../files/selinux/mirrorlist-logrotate.te          |  12 ++++++++++++
 .../mirrormanager/mirrorlist_proxy/tasks/main.yml  |  21 +++++++++++++++++++++
 4 files changed, 33 insertions(+)
 create mode 100644 roles/mirrormanager/mirrorlist_proxy/files/selinux/mirrorlist-logrotate.mod
 create mode 100644 roles/mirrormanager/mirrorlist_proxy/files/selinux/mirrorlist-logrotate.pp
 create mode 100644 roles/mirrormanager/mirrorlist_proxy/files/selinux/mirrorlist-logrotate.te

diff --git a/roles/mirrormanager/mirrorlist_proxy/files/selinux/mirrorlist-logrotate.mod b/roles/mirrormanager/mirrorlist_proxy/files/selinux/mirrorlist-logrotate.mod
new file mode 100644
index 0000000000000000000000000000000000000000..49ca37b8d4e43431ea086fcd61a1d83687dd1a47
GIT binary patch
literal 1204
zcmb`GOHRWu6h%Y%N(>MZ3+M(wumew+!H5M!X=6}OT1$>wI$#Sdm=U}aa;a6Q7|<(S
zzxzIZ{>Xm&czr)BisIpReAmnutMPrP7p)&z=-jwxJTZa`<E)7>#J1_uWgDJiNLBLt
z7QeZ=c4js~8%PO|mR~pV(88?p5}V{tO^}Oz7M8x8S2NG*Osnd;_YX`1=1{6uk4@{3
z%%^r5z3q$6Wc$v?CYaKB+j5FXNOvplV?9oWpuswHEh!=$@8oXIfVMFcV72ab@C4
znWA!&g<}}dEt{CiuA0}AuqruXnUvdR)k{lLr!~-Spz^ZBb2xLL^7H_%AJ+qUa=KwM
zZlLDM63^kxfy&bdxPDv@<RNQp!es$8R6jiqVuCXP|EjT)9&WIhT#p8yn0je{#J0sP
z)x!-Ivn!po{Fmfx+@1YTjwbT=c!ct0`9=CYOjR7sZ^&M}QdnO9Z!bKrv63J71QJ$M
AiU0rr
literal 0
HcmV?d00001
diff --git a/roles/mirrormanager/mirrorlist_proxy/files/selinux/mirrorlist-logrotate.pp b/roles/mirrormanager/mirrorlist_proxy/files/selinux/mirrorlist-logrotate.pp
new file mode 100644
index 0000000000000000000000000000000000000000..f4be1215e3c3fb0c4c15381f8d1c4c5495c70e9b
GIT binary patch
literal 1220
zcmb`GOHRWu6h%Y%N(=yr1+W1S?7$OdFk%5w+87j+Hj?9(4%h->y^P=;lS{2a#Q?5!
z{qFnt`6K)F{rPRHC<=INd@=vX?A`U*O*5M>&u+VV-ujV+PK=Zt7{RG=+Jw-Bw&~+}
z+dYIXR?%-;{OaP;nOO&IASFOre%*v!3$w~oXrezfK`!`dxA5hxntE1eT2<G{-!ToC
zL#bNbH?7|@pV~?Awl6x9O`Z2mFs1jl<rt8V?pV-`AN?ej!6ol=*rZjG=UEwY2=!O*
zyzcAb%E*;6Mdc<7$1tE@G$EFKHLJ(nvgC+mRBn@1FD*@-)<C;~%F7bZ;mm=`(*w9P
zt_Jetbi-uaK+TmUp2L{~m8TDIX<QBDA#1F|WdSr)KRpg&f-?bstFe*<H&{%rM}tpH
zy|h1Ko8p#AaD&DCm(E)LNpd#s&i*Gy6Zv~QLiw`%BK;nwDvstiWG`MREU*8k7oOKx
H$v1oey`EQ}
literal 0
HcmV?d00001
diff --git a/roles/mirrormanager/mirrorlist_proxy/files/selinux/mirrorlist-logrotate.te b/roles/mirrormanager/mirrorlist_proxy/files/selinux/mirrorlist-logrotate.te
new file mode 100644
index 0000000..1028deb
--- /dev/null
+++ b/roles/mirrormanager/mirrorlist_proxy/files/selinux/mirrorlist-logrotate.te
@@ -0,0 +1,12 @@
+module mirrorlist-logrotate 1.0;
+
+require {
+	type logrotate_t;
+	type svirt_sandbox_file_t;
+	class file { setattr create write };
+	class dir { write add_name remove_name };
+}
+
+#============= logrotate_t ==============
+allow logrotate_t svirt_sandbox_file_t:dir { add_name remove_name write };
+allow logrotate_t svirt_sandbox_file_t:file { setattr create write };
diff --git a/roles/mirrormanager/mirrorlist_proxy/tasks/main.yml b/roles/mirrormanager/mirrorlist_proxy/tasks/main.yml
index ebec129..37c45a0 100644
--- a/roles/mirrormanager/mirrorlist_proxy/tasks/main.yml
+++ b/roles/mirrormanager/mirrorlist_proxy/tasks/main.yml
@@ -97,3 +97,24 @@
         cron_file=restart-mirrorlist-containers
   tags:
   - mirrorlist_proxy
+
+# Custom selinux policy to allow logrotate to rotate our mirrorlist logs
+- name: ensure a directory exists for our custom selinux module
+  file: dest=/usr/local/share/mirrorlist-logrotate state=directory
+  tags:
+  - selinux
+  - mirrorlist_proxy
+
+- name: copy over our custom selinux module
+  copy: src=selinux/mirrorlist-logrotate.pp dest=/usr/local/share/mirrorlist-logrotate/mirrorlist-logrotate.pp
+  register: selinux_module
+  tags:
+  - selinux
+  - mirrorlist_proxy
+
+- name: install our custom selinux module
+  command: semodule -i /usr/local/share/mirrorlist-logrotate/mirrorlist-logrotate.pp
+  when: selinux_module|changed
+  tags:
+  - selinux
+  - mirrorlist_proxy
-- 
1.8.3.1


    