Bug 1730782

Summary:

AVC denials from logrotate on multiple containers

Product:

Red Hat OpenStack

Reporter:

Julie Pichon <jpichon>

Component:

openstack-tripleo-heat-templates

Assignee:

Cédric Jeanneret <cjeanner>

Status:

CLOSED ERRATA

QA Contact:

Sasha Smolyak <ssmolyak>

Severity:

high

Docs Contact:

Priority:

high

Version:

13.0 (Queens)

CC:

cjeanner, jschluet, mburns

Target Milestone:

zstream

Keywords:

Triaged, ZStream

Target Release:

13.0 (Queens)

Hardware:

Unspecified

OS:

Unspecified

Whiteboard:

Fixed In Version:

openstack-tripleo-heat-templates-8.3.1-57.el7ost

Doc Type:

No Doc Update

Doc Text:

Story Points:

---

Clone Of:

Environment:

Last Closed:

2019-09-03 16:55:57 UTC

Type:

Bug

Regression:

---

Mount Type:

---

Documentation:

---

CRM:

Verified Versions:

Category:

---

oVirt Team:

---

RHEL 7.3 requirements from Atomic Host:

Cloudforms Team:

---

Target Upstream Version:

Embargoed:

Attachments:

Description	Flags
Audit log	none

Description Julie Pichon 2019-07-17 15:21:52 UTC

Description of problem:

There is a number of AVC denials related to logrotate and containers when running on RHEL 7.7 (cf bug 1730723 comment 1).

type=AVC msg=audit(1563305281.736:9590): avc:  denied  { read } for  pid=269489 comm="logrotate" name="gnocchi" dev="vda2" ino=13572601 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1563305281.738:9591): avc:  denied  { read } for  pid=269489 comm="logrotate" name="aodh" dev="vda2" ino=6028974 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1563305281.739:9592): avc:  denied  { read } for  pid=269489 comm="logrotate" name="ceilometer" dev="vda2" ino=9636557 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1563305281.739:9593): avc:  denied  { read } for  pid=269489 comm="logrotate" name="cinder" dev="vda2" ino=1841627 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1563305281.739:9594): avc:  denied  { read } for  pid=269489 comm="logrotate" name="horizon" dev="vda2" ino=13572607 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1563305281.739:9595): avc:  denied  { read } for  pid=269489 comm="logrotate" name="glance" dev="vda2" ino=6028967 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1563305281.740:9596): avc:  denied  { read } for  pid=269489 comm="logrotate" name="heat" dev="vda2" ino=6028970 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1563305281.741:9597): avc:  denied  { read } for  pid=269489 comm="logrotate" name="keystone" dev="vda2" ino=9636564 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1563305281.741:9598): avc:  denied  { read } for  pid=269489 comm="logrotate" name="neutron" dev="vda2" ino=1841630 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1563305281.742:9599): avc:  denied  { read } for  pid=269489 comm="logrotate" name="nova" dev="vda2" ino=1841634 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1563305281.742:9600): avc:  denied  { read } for  pid=269489 comm="logrotate" name="panko" dev="vda2" ino=13588064 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1563305281.742:9601): avc:  denied  { read } for  pid=269489 comm="logrotate" name="sahara" dev="vda2" ino=1841633 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1563305281.744:9602): avc:  denied  { read } for  pid=269489 comm="logrotate" name="rabbitmq" dev="vda2" ino=6028969 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1563305281.745:9603): avc:  denied  { read } for  pid=269489 comm="logrotate" name="redis" dev="vda2" ino=1841632 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0


Additional info:

This can be fixed by enabling the logrotate_read_inside_containers, which appears to be resolved upstream for later releases https://bugs.launchpad.net/tripleo/+bug/1836000

Comment 1 Julie Pichon 2019-07-17 15:23:09 UTC

Created attachment 1591461 [details]
Audit log

Comment 9 Sasha Smolyak 2019-08-26 08:20:17 UTC

No more denials in audit log. Verified

Comment 11 errata-xmlrpc 2019-09-03 16:55:57 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:2624