| Summary: | SELinux prevents logrotate from calling "systemctl kill" | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | James Ralston <ralston> | ||||
| Component: | selinux-policy-targeted | Assignee: | Miroslav Grepl <mgrepl> | ||||
| Status: | CLOSED EOL | QA Contact: | Ben Levenson <benl> | ||||
| Severity: | unspecified | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 25 | CC: | dwalsh | ||||
| Target Milestone: | --- | Keywords: | Reopened | ||||
| Target Release: | --- | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2017-12-12 11:07:23 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Attachments: |
|
||||||
Created attachment 1115243 [details]
allow logrotate_t self:capability net_admin
For today, I put SELinux in permissive mode, but left dontaudit mode disabled. Here's the audit/syslog output:
type=AVC msg=audit(1452881283.596:15783): avc: denied { net_admin } for pid=21611 comm="systemctl" capability=12 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tclass=capability permissive=1
2016-01-15T13:08:03.679775-05:00 localhost logrotate: about to HUP rsyslog.service; output follows
type=AVC msg=audit(1452881283.680:15788): avc: denied { net_admin } for pid=21627 comm="systemctl" capability=12 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tclass=capability permissive=1
2016-01-15T13:08:03.684680-05:00 localhost logrotate: end of output; return value of pipe was 0
So SELinux is definitively the culprit.
Here's a patch against git://github.com/TresysTechnology/refpolicy.git to add the necessary permission (net_admin).
For now, I can work around this by putting just logrotate_t into permissive mode.
This message is a reminder that Fedora 23 is nearing its end of life. Approximately 4 (four) weeks from now Fedora will stop maintaining and issuing updates for Fedora 23. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as EOL if it remains open with a Fedora 'version' of '23'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version. Thank you for reporting this issue and we are sorry that we were not able to fix it before Fedora 23 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged change the 'version' to a later Fedora version prior this bug is closed as described in the policy above. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete. Fedora 23 changed to end-of-life (EOL) status on 2016-12-20. Fedora 23 is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug. If you can reproduce this bug against a currently maintained version of Fedora please feel free to reopen this bug against that version. If you are unable to reopen this bug, please file a new report against the current release. If you experience problems, please add a comment to this bug. Thank you for reporting this bug and we are sorry it could not be fixed. This is still broken in Fedora 25: $ semanage permissive -d logrotate_t $ date; runcon -u system_u -r system_r -t logrotate_t /usr/bin/systemctl kill -s HUP rsyslog.service && echo succeeded || echo failed Sun Jan 1 16:13:30 MST 2017 runcon: ‘/usr/bin/systemctl’: Permission denied failed $ ausearch -m avc -ts 16:13:29 | audit2allow #============= logrotate_t ============== allow logrotate_t systemd_systemctl_exec_t:file entrypoint; $ semanage permissive -a logrotate_t $ date; runcon -u system_u -r system_r -t logrotate_t /usr/bin/systemctl kill -s HUP rsyslog.service && echo succeeded || echo failed Sun Jan 1 16:15:52 MST 2017 succeeded I explained exactly what was broken back when I reported this problem for Fedora 23, and provided a patch. It's trivial to reproduce this problem. Why wasn't this legitimate problem with SELinux addressed when I first reported it? This message is a reminder that Fedora 25 is nearing its end of life. Approximately 4 (four) weeks from now Fedora will stop maintaining and issuing updates for Fedora 25. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as EOL if it remains open with a Fedora 'version' of '25'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version. Thank you for reporting this issue and we are sorry that we were not able to fix it before Fedora 25 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged change the 'version' to a later Fedora version prior this bug is closed as described in the policy above. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete. Fedora 25 changed to end-of-life (EOL) status on 2017-12-12. Fedora 25 is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug. If you can reproduce this bug against a currently maintained version of Fedora please feel free to reopen this bug against that version. If you are unable to reopen this bug, please file a new report against the current release. If you experience problems, please add a comment to this bug. Thank you for reporting this bug and we are sorry it could not be fixed. |
Description of problem: Starting in Fedora 23, in /etc/logrotate.d/syslog, the rsyslog package uses systemctl to HUP the rsyslog service, instead of performing the HUP itself. Fedora 22: postrotate /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true endscript Fedora 23: postrotate /usr/bin/systemctl kill -s HUP rsyslog.service >/dev/null 2>&1 || true endscript Unfortunately, in Fedora 23, the HUP signal is never delivered to the rsyslog process, so rsyslog continues to write to old (and in many cases, unlinked) log files. If I set SELinux to permissive mode, the logrotate HUP is delivered to the rsyslog process. Yet in both cases, no SELinux audit messages are logged. I replaced the Fedora 23 rsyslog postrotate script with this: postrotate set -o pipefail /usr/bin/logger -p daemon.info -t logrotate "about to HUP rsyslog.service; output follows" /usr/bin/systemctl kill -s HUP rsyslog.service 2>&1 | /usr/bin/xargs -e -r -l /usr/bin/logger -p daemon.info -t logrotate /usr/bin/logger -p daemon.info -t logrotate "end of output; return value of pipe was $?" endscript I then set SELinux back to enforcing mode, disabled dontaudit, and waited for the next logrotate to fire. Here is what is logged, interwoven with the audit messages: 2016-01-14T13:15:04.897576-05:00 localhost logrotate: about to HUP rsyslog.service; output follows ---- time->Thu Jan 14 13:15:04 2016 type=AVC msg=audit(1452795304.902:15108): avc: denied { net_admin } for pid=9084 comm="systemctl" capability=12 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tclass=capability permissive=0 ---- time->Thu Jan 14 13:15:04 2016 type=AVC msg=audit(1452795304.902:15109): avc: denied { net_admin } for pid=9084 comm="systemctl" capability=12 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tclass=capability permissive=0 2016-01-14T13:15:04.907158-05:00 localhost logrotate: Failed to kill unit rsyslog.service: Access denied 2016-01-14T13:15:04.908504-05:00 localhost logrotate: end of output; return value of pipe was 1 The fact that the net_admin denials are hidden by dontaudit mode suggests that the denials are unimportant. But, this is essentially a smoking gun that the net_admin denials, in fact, prevent systemctl from executing. Version-Release number of selected component (if applicable): selinux-policy-targeted-3.13.1-158.fc23.noarch