Bug 1394199
| Summary: | pmlogger_daily cron job failed due to Permission denied by SELinux mismatch | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Kenjiro Nakayama <knakayam> |
| Component: | pcp | Assignee: | Nathan Scott <nathans> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | qe-baseos-tools-bugs |
| Severity: | high | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.2 | CC: | brolley, fche, lberk, mgoodwin, nathans |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2016-11-14 07:08:54 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
I'm sorry! This issue has been fixed in new selinux-policy package (selinux-policy-3.13.1-102.el7_3.4.noarch). I close this ticket. |
Description of problem: pmlogger_daily cron job failed due to Permission denied by SELinux mismatch Version-Release number of selected component (if applicable): - pcp-3.11.3-4.el7.x86_64 - cat /etc/redhat-release Red Hat Enterprise Linux Server release 7.2 (Maipo) How reproducible: Steps to Reproduce: 0. setenforce 1 1. yum -y install pcp 2. systemctl start pmcd.service pmlogger.service 3. Run cron in /etc/cron.d/pcp-pmlogger -> 10 0 * * * pcp /usr/libexec/pcp/bin/pmlogger_daily -X xz -x 3 Actual results: Failed to run above cron due to these errors: - In /var/log/pcp/pmlogger/<HOST>/pmlogger.log: pmlogger: error creating primary logger socket symbolic link /var/run/pcp/pmlogger.primary.socket: Permission denied - In /var/log/audit/audit.log: type=AVC msg=audit(1478864472.026:351788): avc: denied { create } for pid=113260 comm="pmlogger" name="pmlogger.primary.socket" scontext=system_u:system_r:pcp_pmlogger_t:s0-s0:c0.c1023 tcontext=system_u:object_r:pcp_var_run_t:s0 tclass=lnk_file Expected results: - No error and pmlogger_daily runs without error. Additional info: - We confimed that "setenforce 0" fixed this issue, but we need to enable SELinux. - Current labeles are below. I chnaged some patterns like system_u:system_r:pcp_pmlogger_t, but they were not worked. # ls -alZ /var/run/pcp/ drwxrwxr-x. pcp pcp system_u:object_r:pcp_var_run_t:s0 . drwxr-xr-x. root root system_u:object_r:var_run_t:s0 .. -r--r--r--. root root system_u:object_r:pcp_var_run_t:s0 pmcd.pid srw-rw-rw-. root root system_u:object_r:pcp_var_run_t:s0 pmcd.socket srw-rw-rw-. pcp pcp system_u:object_r:pcp_var_run_t:s0 pmlogger.114168.socket