Running latest Rawhide, targeted/enforcing.
When cron runs logrotate, I get AVC on access to /var/log/rpmpkgs:
type=AVC msg=audit(1191172944.569:41): avc: denied { getattr } for pid=6581 comm="logrotate" path="/var/log/rpmpkgs" dev=dm-0 ino=99163 scontext=system_u:system_r:logrotate_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=file type=SYSCALL msg=audit(1191172944.569:41): arch=40000003 syscall=195 success=no exit=-13 a0=8931228 a1=bfa7b320 a2=5b67ff4 a3=0 items=0 ppid=6579 pid=6581 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="logrotate" exe="/usr/sbin/logrotate" subj=system_u:system_r:logrotate_t:s0 key=(null)
Should there be a directory in /var/log for these logs (with the appropriate label)?
tom
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Tom London wrote:
Running latest Rawhide, targeted/enforcing.
When cron runs logrotate, I get AVC on access to /var/log/rpmpkgs:
type=AVC msg=audit(1191172944.569:41): avc: denied { getattr } for pid=6581 comm="logrotate" path="/var/log/rpmpkgs" dev=dm-0 ino=99163 scontext=system_u:system_r:logrotate_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=file type=SYSCALL msg=audit(1191172944.569:41): arch=40000003 syscall=195 success=no exit=-13 a0=8931228 a1=bfa7b320 a2=5b67ff4 a3=0 items=0 ppid=6579 pid=6581 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="logrotate" exe="/usr/sbin/logrotate" subj=system_u:system_r:logrotate_t:s0 key=(null)
Should there be a directory in /var/log for these logs (with the appropriate label)?
tom
How is a file in /var/log being labeled rpmpkgs. Looks like this file is created in / and then mv'd to /var/log?
Daniel J Walsh wrote:
Tom London wrote:
Running latest Rawhide, targeted/enforcing.
When cron runs logrotate, I get AVC on access to /var/log/rpmpkgs:
type=AVC msg=audit(1191172944.569:41): avc: denied { getattr } for pid=6581 comm="logrotate" path="/var/log/rpmpkgs" dev=dm-0 ino=99163 scontext=system_u:system_r:logrotate_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=file type=SYSCALL msg=audit(1191172944.569:41): arch=40000003 syscall=195 success=no exit=-13 a0=8931228 a1=bfa7b320 a2=5b67ff4 a3=0 items=0 ppid=6579 pid=6581 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="logrotate" exe="/usr/sbin/logrotate" subj=system_u:system_r:logrotate_t:s0 key=(null)
Should there be a directory in /var/log for these logs (with the appropriate label)?
tom
How is a file in /var/log being labeled rpmpkgs. Looks like this file is created in / and then mv'd to /var/log?
Don't think so; it should be created by /etc/cron.daily/rpm, which on F7 is:
/bin/rpm -qa --qf '%{name}-%{version}-%{release}.%{arch}.rpm\n' 2>&1 \ | /bin/sort > /var/log/rpmpkgs
Paul.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Paul Howarth wrote:
Daniel J Walsh wrote:
Tom London wrote:
Running latest Rawhide, targeted/enforcing.
When cron runs logrotate, I get AVC on access to /var/log/rpmpkgs:
type=AVC msg=audit(1191172944.569:41): avc: denied { getattr } for pid=6581 comm="logrotate" path="/var/log/rpmpkgs" dev=dm-0 ino=99163 scontext=system_u:system_r:logrotate_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=file type=SYSCALL msg=audit(1191172944.569:41): arch=40000003 syscall=195 success=no exit=-13 a0=8931228 a1=bfa7b320 a2=5b67ff4 a3=0 items=0 ppid=6579 pid=6581 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="logrotate" exe="/usr/sbin/logrotate" subj=system_u:system_r:logrotate_t:s0 key=(null)
Should there be a directory in /var/log for these logs (with the appropriate label)?
tom
How is a file in /var/log being labeled rpmpkgs. Looks like this file is created in / and then mv'd to /var/log?
Don't think so; it should be created by /etc/cron.daily/rpm, which on F7 is:
/bin/rpm -qa --qf '%{name}-%{version}-%{release}.%{arch}.rpm\n' 2>&1 \ | /bin/sort > /var/log/rpmpkgs
Paul.
But not in F8
#!/bin/sh
tmpfile=`/bin/mktemp rpmpkgs.XXXXXXXXX` || exit 1 /bin/rpm -qa --qf '%{name}-%{version}-%{release}.%{arch}.rpm\n' 2>&1 \ | /bin/sort > "$tmpfile"
[ -s "$tmpfile" ] || exit 1 /bin/mv "$tmpfile" /var/log/rpmpkgs /bin/chmod 0644 /var/log/rpmpkgs
This should be.
#!/bin/sh
tmpfile=`/bin/mktemp /var/log/rpmpkgs.XXXXXXXXX` || exit 1 /bin/rpm -qa --qf '%{name}-%{version}-%{release}.%{arch}.rpm\n' 2>&1 \ | /bin/sort > "$tmpfile"
[ -s "$tmpfile" ] || exit 1 /bin/mv "$tmpfile" /var/log/rpmpkgs /bin/chmod 0644 /var/log/rpmpkgs
And the SELinux context would be right.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Paul Howarth wrote:
Daniel J Walsh wrote:
Tom London wrote:
Running latest Rawhide, targeted/enforcing.
When cron runs logrotate, I get AVC on access to /var/log/rpmpkgs:
type=AVC msg=audit(1191172944.569:41): avc: denied { getattr } for pid=6581 comm="logrotate" path="/var/log/rpmpkgs" dev=dm-0 ino=99163 scontext=system_u:system_r:logrotate_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=file type=SYSCALL msg=audit(1191172944.569:41): arch=40000003 syscall=195 success=no exit=-13 a0=8931228 a1=bfa7b320 a2=5b67ff4 a3=0 items=0 ppid=6579 pid=6581 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="logrotate" exe="/usr/sbin/logrotate" subj=system_u:system_r:logrotate_t:s0 key=(null)
Should there be a directory in /var/log for these logs (with the appropriate label)?
tom
How is a file in /var/log being labeled rpmpkgs. Looks like this file is created in / and then mv'd to /var/log?
Don't think so; it should be created by /etc/cron.daily/rpm, which on F7 is:
/bin/rpm -qa --qf '%{name}-%{version}-%{release}.%{arch}.rpm\n' 2>&1 \ | /bin/sort > /var/log/rpmpkgs
Paul.
https://bugzilla.redhat.com/show_bug.cgi?id=315271
selinux@lists.fedoraproject.org