Bug 1339002

I think this will need to be assigned to "selinux-policy-targeted" to add a new file context for the stderr log file /var/log/boincerr.log and it's rotated logs.

e.g.

semanage fcontext --add --type boinc_log_t --ftype f '/var/log/boincerr\.log.*'

There is already a rule for the stdout logs ('/var/log/boinc\.log.*').

I'm still on F22 with:
boinc-client-7.2.42-8.gitdd0d630.fc22.x86_64
selinux-policy-targeted-3.13.1-128.28.fc22.noarch

Let me know if I can be of any help.

--DaveG.

It is not a SELinux problem because it happens even when SELinux is in permissive mode

I'd try running without the log file symlinks or redirection:

for 7.2
systemctl stop boinc-client.service
rm -f /var/lib/boinc/{stderrdae.txt,stdoutdae.txt}

for 7.6
remove the ENVIRONMENT assignments from the systemd unit file and reload.

then restart and check that boinc created it's private log files.
ls -lZ /var/lib/boinc/std*

The only other thing I can think of is that boinc 7.4 introduced fine-grained log flags [https://boinc.berkeley.edu/wiki/Release_Notes_for_BOINC_7.4] so it might be worth checking your cc_config.xml <log_flags> [https://boinc.berkeley.edu/wiki/Client_configuration].

I'll try to do a local build of 7.6 from fedoraprojects git later or pick up a binary from koji.

--DaveG.

Tried boinc-client-7.6.22-4.fc23.x86_64 from updates-testing in a spare F23 Workstation VM.

To get it working for me:
dnf --enablerepo=updates-testing install boinc-client boinc-manager
semanage fcontext --add --type boinc_log_t '/var/log/boincerr\.log.*'
ln -s /var/log/boincerr.log /var/lib/boinc/stderrdae.txt
ln -s /var/log/boinc.log /var/lib/boinc/stdoutdae.txt
restorecon -Fv /var/lib/boinc/std*.txt /var/log/boinc*
systemctl start boinc-client.service

I think your issue is that the ENVIRONMENT assignments in your systemd unit file are for the old init scripts. They used command-line redirection when starting the BOINC client, not used in the client binary itself.

The move to systemd initially used a "helper" script to do the redirection, executed from the unit file. This, unfortunately, broke the SELinux transition chain so the BOINC client ran unconfined.

The unit file needs to run the binary client directly (for confinement) and the simplest way was to use --deamon mode that causes the client to send standard output and error streams to files in the working directory. The alternative would have been to configure the unit file to send raw standard output and error to the journal. The BOINC client adds it's own time-stamps etc. to each message making the journal output rather verbose and less than useful.

Fedora has historically kept log files in /var/log so the daemon mode log files in /var/lib/boinc were replaced with symbolic links to files in /var/log. The trick is to maintain mode, ownership and context on all four file objects, and allow logrotate to operate as intended.

One option is to duck the issue and leave the logs in /var/lib/boinc. That will require just a change to the logrotate script file names and, possibly, permission to deviate from packaging standards. The other option is to work out a reliable way to maintain the log files in /var/log and the symbolic links in /var/lib/boinc.

BOINC client does not have a signal handler to re-open log files, so log rotation is awkward. Rather than stop and start the client (which can cause it to discard work in some cases) the "copytruncate" option can be used. This makes the logrotate script much simpler and allows BOINC to run uninterrupted. There is a small chance that log lines could be lost during the copy/truncate, but not loose work.

In summary...

* Update package spec file %build section to create symbolic links.
# Set up links to correct log locations
ln -s %{_localstatedir}/log/boincerr.log $RPM_BUILD_ROOT%{_localstatedir}/lib/boinc/stderrdae.txt
ln -s %{_localstatedir}/log/boinc.log $RPM_BUILD_ROOT%{_localstatedir}/lib/boinc/stdoutdae.txt

* Include the symbolic links and targets in the %files section.
%{_localstatedir}/lib/boinc/stderrdae.txt
%{_localstatedir}/lib/boinc/stdoutdae.txt
%ghost %{_localstatedir}/log/boinc.log
%ghost %{_localstatedir}/log/boincerr.log

* Simplify the logrotate script e.g.
/var/log/boinc.log /var/log/boincerr.log {
	missingok
	notifempty
	copytruncate
	compress
	delaycompress
	nomail
}

* Raise a bug against selinux-policy-targeted to achieve:
semanage fcontext --add --type boinc_log_t '/var/log/boincerr\.log.*'

I have not tried the above in a build, but it should "package" what I needed to do with the updates-testing package to have it work as expected.

Hope this helps,

--DaveG.

DaveG thank you for your extensive and clear explanation. I would like also to check if it is possible to write a little patch file to BOINC source code, in order to force BOINC to directly write the logs into /var/log/ rather than its working directory.
I will keep you informed.

I just had a very positive feedback about asking which part of BOINC source code should be edited https://boinc.berkeley.edu/dev/forum_thread.php?id=11011&postid=69830
Hope to have soon some free time to start working on it. Any contribution is appreciated :-)

Have a nice day

This bug appears to have been reported against 'rawhide' during the Fedora 26 development cycle.
Changing version to '26'.

boinc-client-7.8.4-4.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2018-c5adadff4b

boinc-client-7.8.4-4.fc26 has been submitted as an update to Fedora 26. https://bodhi.fedoraproject.org/updates/FEDORA-2018-2b3588f034

The fix will make logs available under journalctl utility

boinc-client-7.8.4-4.fc26 has been pushed to the Fedora 26 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-2b3588f034

boinc-client-7.8.4-4.fc27 has been pushed to the Fedora 27 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-c5adadff4b

boinc-client-7.8.4-4.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug report.

boinc-client-7.8.4-4.fc26 has been pushed to the Fedora 26 stable repository. If problems still persist, please make note of it in this bug report.