Bug 1375675

Summary:	atomic run sadc: Unauthorized SELinux unlabeled_t /etc/cron.d/sysstat
Product:	Red Hat Enterprise Linux 7	Reporter:	Chris Evich <cevich>
Component:	sadc-container	Assignee:	Jeremy Eder <jeder>
Status:	CLOSED CURRENTRELEASE	QA Contact:	atomic-bugs <atomic-bugs>
Severity:	medium	Docs Contact:	Vikram Goyal <vigoyal>
Priority:	unspecified
Version:	7.2	CC:	fkluknav, sct
Target Milestone:	rc
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-09-06 12:11:28 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:

Description Chris Evich 2016-09-13 16:24:06 UTC

Description of problem:


Version-Release number of selected component (if applicable):
registry.access.../rhel7/sadc 7.2-22 e28c21c5642b

How reproducible:
100%

Steps to Reproduce:
1. Update/Rebase RHELAH to 7.2.7
2. atomic install registry.access.../rhel7/sadc:7.2-22
3. atomic run registry.access.../rhel7/sadc:7.2-22

Actual results:
(from logs)
Sep 13 11:22:01 localhost.localdomain crond[747]: ((null)) Unauthorized SELinux context=system_u:system_r:system_cronjob_t:s0-s0:c0.c1023 file_context=system_u:object_r:unlabeled_t:s0 (/etc/cron.d/sysstat)
...cut...
Sep 13 11:22:01 localhost.localdomain crond[747]: (root) FAILED (loading cron table)

Expected results:
Sep 13 11:27:33 localhost.localdomain systemd[1]: Reloaded Command Scheduler.
...cut...
Sep 13 11:30:01 localhost.localdomain CROND[13748]: (root) CMD (docker exec -d sadc /usr/lib64/sa/sa1 1 1)

Additional info:
# ls -laZ /etc/cron.d/sysstat /etc/sysconfig/sysstat /etc/sysconfig/sysstat.ioconf /usr/local/bin/sysstat.sh
-rw-r--r--. root root system_u:object_r:unlabeled_t:s0 /etc/cron.d/sysstat
-rw-r--r--. root root system_u:object_r:unlabeled_t:s0 /etc/sysconfig/sysstat
-rw-r--r--. root root system_u:object_r:unlabeled_t:s0 /etc/sysconfig/sysstat.ioconf
-rwxr-xr-x. root root system_u:object_r:unlabeled_t:s0 /usr/local/bin/sysstat.sh

# fixfiles relabel /etc/cron.d/sysstat /etc/sysconfig/sysstat /etc/sysconfig/sysstat.ioconf /usr/local/bin/sysstat.sh
...cut...
# ls -laZ /etc/cron.d/sysstat /etc/sysconfig/sysstat /etc/sysconfig/sysstat.ioconf /usr/local/bin/sysstat.sh
-rw-r--r--. root root system_u:object_r:system_cron_spool_t:s0 /etc/cron.d/sysstat
-rw-r--r--. root root system_u:object_r:etc_t:s0       /etc/sysconfig/sysstat
-rw-r--r--. root root system_u:object_r:etc_t:s0       /etc/sysconfig/sysstat.ioconf
-rwxr-xr-x. root root system_u:object_r:var_t:s0       /usr/local/bin/sysstat.sh

# systemctl reload crond
(expected results logged)

Comment 4 Frantisek Kluknavsky 2018-09-06 12:11:28 UTC

not closed by mistake