Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 648844 - selinux-logrotate status file path needs to be updated
Summary: selinux-logrotate status file path needs to be updated
Status: IN_PROGRESS
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: SELinux (show other bugs)
Hardware: All Linux
: Normal normal with 1 vote (vote)
Assignee: SE Linux Bugs
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-02-26 13:54 UTC by gen2dev
Modified: 2019-02-18 14:31 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description gen2dev 2018-02-26 13:54:49 UTC
I'm getting "denied" events in the audit log for logrotate:
  type=AVC msg=audit(1519632601.131:956): avc:  denied  { create } for  pid=18754 comm="logrotate" name="logrotate.status.tmp" scontext=system_u:system_r:logrotate_t tcontext=system_u:object_r:var_lib_t tclass=file permissive=1
  type=AVC msg=audit(1519632601.131:956): avc:  denied  { write } for  pid=18754 comm="logrotate" path="/var/lib/misc/logrotate.status.tmp" dev="sda2" ino=2843162 scontext=system_u:system_r:logrotate_t tcontext=system_u:object_r:var_lib_t tclass=file permissive=1
  type=AVC msg=audit(1519632601.131:957): avc:  denied  { setattr } for  pid=18754 comm="logrotate" name="logrotate.status.tmp" dev="sda2" ino=2843162 scontext=system_u:system_r:logrotate_t tcontext=system_u:object_r:var_lib_t tclass=file permissive=1
  type=AVC msg=audit(1519632601.135:958): avc:  denied  { rename } for  pid=18754 comm="logrotate" name="logrotate.status.tmp" dev="sda2" ino=2843162 scontext=system_u:system_r:logrotate_t tcontext=system_u:object_r:var_lib_t tclass=file permissive=1

logrotate is now putting the status file in /var/log/misc/ per bug 357275, but the policy still has it in /var/lib/.
  /var/lib/logrotate(/.*)?      system_u:object_r:logrotate_var_lib_t
  /var/lib/logrotate\.status    --      system_u:object_r:logrotate_var_lib_t

app-admin/logrotate-3.13.0
sec-policy/selinux-logrotate-2.20180114-r1
Comment 1 Mira Ressel 2018-10-12 21:51:28 UTC
Patch submitted to upstream, it'll land in our next policy release. Apologies for the long delay!