Bug 1278076

Summary: Log rotate generates SELinux permission errors
Product: Red Hat CloudForms Management Engine Reporter: Nick Carboni <ncarboni>
Component: ApplianceAssignee: Gregg Tanzillo <gtanzill>
Status: CLOSED ERRATA QA Contact: Milan Falešník <mfalesni>
Severity: low Docs Contact:
Priority: unspecified    
Version: 5.5.0CC: abellott, cpelland, jfrey, jhardy, mfalesni, obarenbo, simaishi, tcarlin
Target Milestone: GA   
Target Release: 5.5.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: 5.5.0.11 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-12-08 13:44:08 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Nick Carboni 2015-11-04 16:30:37 UTC
Description of problem:
During log rotate the file at /opt/rh/cfme-gemset/enable gets sourced.

This file attempts to link and remove files that the logrotate_t context cannot touch.
These errors generate mail to /var/spool/mail/root.

Before https://bugzilla.redhat.com/show_bug.cgi?id=1265463 was resolved, log rotate would fail because the source of /etc/default/evm would exit with an error status.

This may be a more widespread issue with services which do not have privileges to touch the files referenced in /opt/rh/cfme-gemset/enable 

The ideal solution would be to keep operations in files sourced by /etc/default/evm limited to setting environment variables and move operations which require specific privileges to other scripts which are only called by the processes which actually need them to be run.

Version-Release number of selected component (if applicable):
5.5.0.9-2

How reproducible:
Always

Steps to Reproduce:
1.Allow logrotate to run (daily)
2.Examine mail in /var/spool/mail/root
3.

Actual results:
Many errors

Expected results:
No mail is sent by log rotate as a result of sourcing /etc/default/evm

Additional info:
Errors seen in /var/spool/mail/root:

From root.localdomain  Wed Nov  4 03:46:52 2015
Return-Path: <root.localdomain>
X-Original-To: root
Delivered-To: root.localdomain
Received: by localhost.localdomain.localdomain (Postfix, from userid 0)
	id 9A2D327561; Wed,  4 Nov 2015 03:46:51 -0500 (EST)
From: Anacron <root.localdomain>
To: root.localdomain
Content-Type: text/plain; charset="UTF-8"
Subject: Anacron job 'cron.daily' on localhost.localdomain.localdomain
Message-Id: <20151104084651.9A2D327561.localdomain>
Date: Wed,  4 Nov 2015 03:46:51 -0500 (EST)

/etc/cron.daily/logrotate:

rm: cannot remove ‘/var/www/miq/vmdb/Gemfile.lock’: Permission denied
ln: failed to create symbolic link ‘/var/www/miq/vmdb/Gemfile.lock’: File exists
rm: cannot remove ‘/var/www/miq/vmdb/.bundle’: Permission denied
ln: failed to create symbolic link ‘/var/www/miq/vmdb/.bundle/.bundle’: Permission denied
rm: cannot remove ‘/var/www/miq/vmdb/bin’: Permission denied
cp: cannot create directory ‘/var/www/miq/vmdb/bin/bin’: Permission denied
rm: cannot remove ‘/var/www/miq/vmdb/Gemfile.lock’: Permission denied
ln: failed to create symbolic link ‘/var/www/miq/vmdb/Gemfile.lock’: File exists
rm: cannot remove ‘/var/www/miq/vmdb/.bundle’: Permission denied
ln: failed to create symbolic link ‘/var/www/miq/vmdb/.bundle/.bundle’: Permission denied
rm: cannot remove ‘/var/www/miq/vmdb/bin’: Permission denied
cp: cannot create directory ‘/var/www/miq/vmdb/bin/bin’: Permission denied

Comment 2 Jason Frey 2015-11-17 22:31:25 UTC
Related to BZ1278202

Fixed in our cfme-gemset RPM spec by separating the parts of the enable script that are really for one-time setup into a setup script, and calling the setup script from the kickstart.

http://pkgs.devel.redhat.com/cgit/rpms/cfme-gemset/commit/?h=cfme-rh-ruby22-5.5-rhel-7&id=1786f29bfbd65ad2306a993b6c9d2fb467fb9cf8
http://pkgs.devel.redhat.com/cgit/rpms/cfme-appliance/commit/?h=cfme-5.5-rhel-7&id=68780064a4dd1259a35d3794a16cd05ac0a32111

Comment 3 Milan Falešník 2015-11-23 14:48:28 UTC
I got no e-mails with errors on 5.5.0.11. /var/log/cron shows that logrotate has run.

Comment 5 errata-xmlrpc 2015-12-08 13:44:08 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2015:2551