Bug 1669146

Summary: rsyslog on controller node can't write haproxy log to /var/log/containers/haproxy
Product: Red Hat OpenStack Reporter: Damien Ciabrini <dciabrin>
Component: openstack-selinuxAssignee: Julie Pichon <jpichon>
Status: CLOSED ERRATA QA Contact: Jon Schlueter <jschluet>
Severity: medium Docs Contact:
Priority: medium    
Version: 13.0 (Queens)CC: bperkins, jpichon, knoha, lhh, mgrepl
Target Milestone: z5Keywords: Rebase, Triaged, ZStream
Target Release: 13.0 (Queens)   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: openstack-selinux-0.8.17-1.el7ost Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 1671792 (view as bug list) Environment:
Last Closed: 2019-03-14 13:34:20 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1600865, 1672940    

Description Damien Ciabrini 2019-01-24 12:57:48 UTC 
Description of problem:
In OpenStack, in order to make a containerized haproxy log into a file, one must use rsyslog on the host and write a dedicated config file to log into /var/log/containers/haproxy/

For our OpenStack deployment, the location for all logs is in /var/log/containers/, and the parent directory /var/log/containers is mounted with ":rw,z" flag by the crontab container, meaning all the content will see its context switched to container_file_t.

This context currently prevents rsyslog writing haproxy logs in the standard
location /var/log/containers/haproxy.

A fix is available upstream [1] to allow writing to such location.

[1] https://github.com/redhat-openstack/openstack-selinux/pull/20

How reproducible:
Always

Steps to Reproduce:
1. Enable SELinux and deploy OSP13 with https://review.openstack.org/620601

Actual results:
logs can't be written to the expected location

Expected results:
logs should be written to expected location

Additional info:
The PR mentionned above has been merged upstream
Comment 1 Keigo Noha 2019-01-30 01:01:17 UTC 
Hi Julie,

Is it possible to merge the fix into RHOSP13z5?

Regards,
Keigo Noha
Comment 2 Julie Pichon 2019-01-30 18:05:10 UTC 
I am currently looking into this. I am not sure if this will be in z5, I will update when I find out.
Comment 17 errata-xmlrpc 2019-03-14 13:34:20 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2019:0564