Bug 1786852

Description of problem:
I ran "fixfiles onboot" aka relabeling and noticed it complained about multiple definisions of some log file.

So at midnight I got this SELinux alert, but remembering that warning I took a moment to check and take a look:
# ll -Z /var/log/boot.log
-rw-r--r--. 2 root root system_u:object_r:plymouthd_spool_t:s0 151091 12-27 19:22 /var/log/boot.log

# restorecon -v /var/log/boot.log
Relabeled /var/log/boot.log from system_u:object_r:plymouthd_spool_t:s0 to system_u:object_r:plymouthd_var_log_t:s0

# ll -Z /var/log/boot.log
-rw-r--r--. 2 root root system_u:object_r:plymouthd_var_log_t:s0 151091 12-27 19:22 /var/log/boot.log

# restorecon -v /var/spool/plymouth/boot.log
Relabeled /var/spool/plymouth/boot.log from system_u:object_r:plymouthd_var_log_t:s0 to system_u:object_r:plymouthd_spool_t:s0

# ll -Z /var/log/boot.log
-rw-r--r--. 2 root root system_u:object_r:plymouthd_spool_t:s0 151091 12-27 19:22 /var/log/boot.log

It's a hardlinked file that resides in two directories with two different labels, and autorelabel breaks that by picking the wrong one, I guess.

Not many people relabel their F31s I imagine, so this doesn't pop up often. It wasn't actually necessary for me either, I was only making sure everything is fine while investigating an unrelated issue.
SELinux is preventing logrotate from 'getattr' accesses on the plik /var/log/boot.log.

*****  Plugin restorecon (99.5 confidence) suggests   ************************

Aby naprawić etykietę. 
domyślna etykieta /var/log/boot.log powinna wynosić plymouthd_var_log_t.
Then można wykonać polecenie restorecon. Próba dostępu mogła zostać zatrzymana z powodu niewystarczających uprawnień dostępu do katalogu nadrzędnego, więc należy odpowiednio zmienić poniższe polecenie.
Do
# /sbin/restorecon -v /var/log/boot.log

*****  Plugin catchall (1.49 confidence) suggests   **************************

Aby logrotate powinno mieć domyślnie getattr dostęp do boot.log file.
Then proszę to zgłosić jako błąd.
Można utworzyć lokalny moduł polityki, aby umożliwić ten dostęp.
Do
można tymczasowo zezwolić na ten dostęp wykonując polecenia:
# ausearch -c 'logrotate' --raw | audit2allow -M my-logrotate
# semodule -X 300 -i my-logrotate.pp

Additional Information:
Source Context                system_u:system_r:logrotate_t:s0
Target Context                system_u:object_r:plymouthd_spool_t:s0
Target Objects                /var/log/boot.log [ file ]
Source                        logrotate
Source Path                   logrotate
Port                          <Nieznane>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.14.4-43.fc31.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 5.4.5-300.fc31.x86_64 #1 SMP Thu
                              Dec 19 19:37:41 UTC 2019 x86_64 x86_64
Alert Count                   2
First Seen                    2019-12-28 00:00:01 CET
Last Seen                     2019-12-28 00:00:01 CET
Local ID                      38494206-41d2-4e4a-a5d1-f12582a9a0a8

Raw Audit Messages
type=AVC msg=audit(1577487601.405:8275): avc:  denied  { getattr } for  pid=58954 comm="logrotate" path="/var/log/boot.log" dev="md1" ino=3213411 scontext=system_u:system_r:logrotate_t:s0 tcontext=system_u:object_r:plymouthd_spool_t:s0 tclass=file permissive=0


Hash: logrotate,logrotate_t,plymouthd_spool_t,file,getattr

Version-Release number of selected component:
selinux-policy-3.14.4-43.fc31.noarch

Additional info:
component:      selinux-policy
reporter:       libreport-2.11.3
hashmarkername: setroubleshoot
kernel:         5.4.5-300.fc31.x86_64
type:           libreport