Attachment 952055 Details for Bug 1158835 – The details output

The details output

details.txt (text/plain), 5.61 KB, created by Nikos Mavrogiannopoulos on 2014-10-30 10:41:58 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Nikos Mavrogiannopoulos

Created: 2014-10-30 10:41:58 UTC

Size: 5.61 KB

patch

obsolete

>SELinux is preventing /usr/sbin/logrotate from create access on the file logrotate.status.tmp.
>
>*****  Plugin catchall_labels (83.8 confidence) suggests   *******************
>
>If you want to allow logrotate to have create access on the logrotate.status.tmp file
>Then you need to change the label on logrotate.status.tmp
>Do
># semanage fcontext -a -t FILE_TYPE 'logrotate.status.tmp'
>where FILE_TYPE is one of the following: NetworkManager_log_t, abrt_var_cache_t, abrt_var_log_t, acct_data_t, afs_logfile_t, aide_log_t, amanda_log_t, antivirus_log_t, apcupsd_log_t, apmd_log_t, asterisk_log_t, auth_cache_t, bacula_log_t, bitlbee_log_t, boinc_log_t, calamaris_log_t, callweaver_log_t, canna_log_t, ccs_var_lib_t, ccs_var_log_t, certmaster_var_log_t, cfengine_log_t, cgred_log_t, checkpc_log_t, chronyd_var_log_t, cinder_log_t, cloud_log_t, cluster_var_log_t, cobbler_var_log_t, condor_log_t, conman_log_t, consolekit_log_t, couchdb_log_t, cron_log_t, ctdbd_log_t, cupsd_log_t, cyphesis_log_t, ddclient_log_t, deltacloudd_log_t, denyhosts_var_log_t, devicekit_var_log_t, dirsrv_snmp_var_log_t, dirsrv_var_log_t, dlm_controld_var_log_t, dnsmasq_var_log_t, docker_log_t, dovecot_var_log_t, dspam_log_t, evtchnd_var_log_t, exim_log_t, fail2ban_log_t, faillog_t, fenced_var_log_t, fetchmail_log_t, fingerd_log_t, firewalld_var_log_t, foghorn_var_log_t, fsadm_log_t, gear_log_t, getty_log_t, gfs_controld_var_log_t, glance_log_t, glusterd_log_t, groupd_var_log_t, haproxy_var_log_t, httpd_log_t, icecast_log_t, inetd_log_t, initrc_var_log_t, innd_log_t, ipsec_log_t, iscsi_log_t, iwhd_log_t, jetty_log_t, jockey_var_log_t, kadmind_log_t, keystone_log_t, kismet_log_t, krb5kdc_log_t, ksmtuned_log_t, ktalkd_log_t, lastlog_t, logrotate_lock_t, logrotate_tmp_t, logrotate_var_lib_t, mailman_log_t, mcelog_log_t, minidlna_log_t, mirrormanager_log_t, mongod_log_t, motion_log_t, mpd_log_t, mrtg_log_t, munin_log_t, mysqld_log_t, mythtv_var_log_t, naemon_log_t, nagios_log_t, named_cache_t, named_log_t, neutron_log_t, nova_log_t, nscd_log_t, ntpd_log_t, numad_var_log_t, openshift_log_t, openshift_var_lib_t, opensm_log_t, openvpn_status_t, openvpn_var_log_t, openvswitch_log_t, openwsman_log_t, osad_log_t, passenger_log_t, pcp_log_t, piranha_log_t, pki_ra_log_t, pki_tomcat_log_t, pki_tps_log_t, plymouthd_var_log_t, polipo_log_t, postgresql_log_t, pppd_log_t, pptp_log_t, prelink_log_t, prelude_log_t, privoxy_log_t, procmail_log_t, psad_var_log_t, puppet_log_t, pyicqt_log_t, qdiskd_var_log_t, rabbitmq_var_log_t, radiusd_log_t, redis_log_t, rhev_agentd_log_t, rhsmcertd_log_t, ricci_modcluster_var_log_t, ricci_var_log_t, rpm_log_t, rsync_log_t, rtas_errd_log_t, samba_log_t, sanlock_log_t, sectool_var_log_t, sendmail_log_t, sensord_log_t, setroubleshoot_var_log_t, shorewall_log_t, slapd_log_t, slpd_log_t, smsd_log_t, snapperd_log_t, snmpd_log_t, snort_log_t, spamd_log_t, speech-dispatcher_log_t, squid_log_t, sssd_var_log_t, stapserver_log_t, sysstat_log_t, systemd_passwd_var_run_t, thin_aeolus_configserver_log_t, thin_log_t, tomcat_log_t, tor_var_log_t, tuned_log_t, ulogd_var_log_t, uucpd_log_t, var_log_t, var_spool_t, varnishlog_log_t, vdagent_log_t, virt_cache_t, virt_log_t, virt_qemu_ga_log_t, vmware_log_t, watchdog_log_t, winbind_log_t, wtmp_t, xdm_log_t, xend_var_log_t, xenstored_var_log_t, xferlog_t, xserver_log_t, zabbix_log_t, zarafa_deliver_log_t, zarafa_gateway_log_t, zarafa_ical_log_t, zarafa_indexer_log_t, zarafa_monitor_log_t, zarafa_server_log_t, zarafa_spooler_log_t, zebra_log_t, zoneminder_log_t. 
>Then execute: 
>restorecon -v 'logrotate.status.tmp'
>
>
>*****  Plugin catchall (17.1 confidence) suggests   **************************
>
>If you believe that logrotate should be allowed create access on the logrotate.status.tmp file by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep logrotate /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>Additional Information:
>Source Context                system_u:system_r:logrotate_t:s0-s0:c0.c1023
>Target Context                unconfined_u:object_r:var_lib_t:s0
>Target Objects                logrotate.status.tmp [ file ]
>Source                        logrotate
>Source Path                   /usr/sbin/logrotate
>Port                          <Unknown>
>Host                          localhost.localdomain
>Source RPM Packages           logrotate-3.8.7-4.fc21.x86_64
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.13.1-90.fc21.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Enforcing
>Host Name                     localhost.localdomain
>Platform                      Linux localhost.localdomain 3.17.1-304.fc21.x86_64
>                              #1 SMP Sat Oct 25 00:56:36 UTC 2014 x86_64 x86_64
>Alert Count                   1
>First Seen                    2014-10-30 11:31:01 CET
>Last Seen                     2014-10-30 11:31:01 CET
>Local ID                      11fc344e-235e-4358-a073-7c5c2564ef56
>
>Raw Audit Messages
>type=AVC msg=audit(1414665061.874:1051): avc:  denied  { create } for  pid=2796 comm="logrotate" name="logrotate.status.tmp" scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=file permissive=0
>
>
>type=SYSCALL msg=audit(1414665061.874:1051): arch=x86_64 syscall=open success=no exit=EACCES a0=11844d0 a1=202c2 a2=180 a3=e1 items=0 ppid=2794 pid=2796 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=2 comm=logrotate exe=/usr/sbin/logrotate subj=system_u:system_r:logrotate_t:s0-s0:c0.c1023 key=(null)
>
>Hash: logrotate,logrotate_t,var_lib_t,file,create
>

Actions: View

Attachments on bug 1158835: 952055