Bug 2156763

Michael,

Could you gather all denials with full auditing enabled?

0) Set SELinux to permissive:
  # setenforce 0
1) Open the /etc/audit/rules.d/audit.rules file in an editor.
2) Remove the following line if it exists:
-a task,never
3) Add the following line to the end of the file:
-w /etc/shadow -p w
4) Restart the audit daemon:
  # service auditd restart
5) Re-run your scenario.
6) Collect AVC denials:
  # ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts today
0) Set SELinux to enforcing:
  # setenforce 1

Rotating logs using logrotate is not sufficient?

Caught in enforcing mode:
----
type=PROCTITLE msg=audit(01/18/2023 10:46:59.334:633) : proctitle=/usr/bin/icecast -c /etc/icecast.xml 
type=PATH msg=audit(01/18/2023 10:46:59.334:633) : item=3 name=/var/log/icecast/error.log.20230118_104659 nametype=CREATE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=PATH msg=audit(01/18/2023 10:46:59.334:633) : item=2 name=/var/log/icecast/error.log inode=262247 dev=fc:02 mode=file,644 ouid=icecast ogid=icecast rdev=00:00 obj=system_u:object_r:icecast_log_t:s0 nametype=DELETE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=PATH msg=audit(01/18/2023 10:46:59.334:633) : item=1 name=/var/log/icecast/ inode=262246 dev=fc:02 mode=dir,755 ouid=icecast ogid=icecast rdev=00:00 obj=system_u:object_r:icecast_log_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=PATH msg=audit(01/18/2023 10:46:59.334:633) : item=0 name=/var/log/icecast/ inode=262246 dev=fc:02 mode=dir,755 ouid=icecast ogid=icecast rdev=00:00 obj=system_u:object_r:icecast_log_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(01/18/2023 10:46:59.334:633) : cwd=/ 
type=SYSCALL msg=audit(01/18/2023 10:46:59.334:633) : arch=x86_64 syscall=rename success=no exit=EACCES(Permission denied) a0=0x55ae6d7235b0 a1=0x7f0473fbe5e0 a2=0x55ae6d06501b a3=0x0 items=4 ppid=1 pid=1853 auid=unset uid=icecast gid=icecast euid=icecast suid=icecast fsuid=icecast egid=icecast sgid=icecast fsgid=icecast tty=(none) ses=unset comm=icecast exe=/usr/bin/icecast subj=system_u:system_r:icecast_t:s0 key=(null) 
type=AVC msg=audit(01/18/2023 10:46:59.334:633) : avc:  denied  { remove_name } for  pid=1853 comm=icecast name=error.log dev="vda2" ino=262247 scontext=system_u:system_r:icecast_t:s0 tcontext=system_u:object_r:icecast_log_t:s0 tclass=dir permissive=0 
----

# rpm -qa selinux\* icecast\* | sort
icecast-2.4.4-11.fc36.x86_64
icecast-doc-2.4.4-11.fc36.noarch
selinux-policy-36.17-1.fc36.noarch
selinux-policy-targeted-36.17-1.fc36.noarch
# grep -i logsize /etc/icecast.xml 
        <logsize>10</logsize> <!-- Max size of a logfile -->
        <!-- If logarchive is enabled (1), then when logsize is reached
# grep -i logarchive /etc/icecast.xml 
        <!-- If logarchive is enabled (1), then when logsize is reached
        <logarchive>1</logarchive>
#

The SELinux denial appears many times during a restart of the icecast service when the logarchive option is enabled and the logsize option is small enough.

Caught in permissive mode:
----
type=PROCTITLE msg=audit(01/18/2023 10:51:31.550:640) : proctitle=/usr/bin/icecast -c /etc/icecast.xml 
type=PATH msg=audit(01/18/2023 10:51:31.550:640) : item=3 name=/var/log/icecast/error.log.20230118_105131 inode=262247 dev=fc:02 mode=file,644 ouid=icecast ogid=icecast rdev=00:00 obj=system_u:object_r:icecast_log_t:s0 nametype=CREATE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=PATH msg=audit(01/18/2023 10:51:31.550:640) : item=2 name=/var/log/icecast/error.log inode=262247 dev=fc:02 mode=file,644 ouid=icecast ogid=icecast rdev=00:00 obj=system_u:object_r:icecast_log_t:s0 nametype=DELETE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=PATH msg=audit(01/18/2023 10:51:31.550:640) : item=1 name=/var/log/icecast/ inode=262246 dev=fc:02 mode=dir,755 ouid=icecast ogid=icecast rdev=00:00 obj=system_u:object_r:icecast_log_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=PATH msg=audit(01/18/2023 10:51:31.550:640) : item=0 name=/var/log/icecast/ inode=262246 dev=fc:02 mode=dir,755 ouid=icecast ogid=icecast rdev=00:00 obj=system_u:object_r:icecast_log_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(01/18/2023 10:51:31.550:640) : cwd=/ 
type=SYSCALL msg=audit(01/18/2023 10:51:31.550:640) : arch=x86_64 syscall=rename success=yes exit=0 a0=0x55ae6d7235b0 a1=0x7ffd3d7034b0 a2=0x55ae6d06501b a3=0x0 items=4 ppid=1 pid=1853 auid=unset uid=icecast gid=icecast euid=icecast suid=icecast fsuid=icecast egid=icecast sgid=icecast fsgid=icecast tty=(none) ses=unset comm=icecast exe=/usr/bin/icecast subj=system_u:system_r:icecast_t:s0 key=(null) 
type=AVC msg=audit(01/18/2023 10:51:31.550:640) : avc:  denied  { rename } for  pid=1853 comm=icecast name=error.log dev="vda2" ino=262247 scontext=system_u:system_r:icecast_t:s0 tcontext=system_u:object_r:icecast_log_t:s0 tclass=file permissive=1 
type=AVC msg=audit(01/18/2023 10:51:31.550:640) : avc:  denied  { remove_name } for  pid=1853 comm=icecast name=error.log dev="vda2" ino=262247 scontext=system_u:system_r:icecast_t:s0 tcontext=system_u:object_r:icecast_log_t:s0 tclass=dir permissive=1 
----

# ls -lZ /var/log/icecast/
total 24
-rw-r--r--. 1 icecast icecast system_u:object_r:icecast_log_t:s0     0 Jan 18 10:30 access.log
-rw-r--r--. 1 icecast icecast system_u:object_r:icecast_log_t:s0   864 Jan 18 10:51 error.log
-rw-r--r--. 1 icecast icecast system_u:object_r:icecast_log_t:s0 19057 Jan 18 10:46 error.log.20230118_105131
#

Test coverage for this BZ exists in a form of PR:
 * https://src.fedoraproject.org/tests/selinux/pull-request/354

The PR waits for review.

These denials, not related to the reported issue, also appear in rawhide (selinux-policy-38-5.fc38.noarch), but not in F37 (selinux-policy-37.18-1.fc37.noarch):

----
type=PROCTITLE msg=audit(01/27/2023 10:26:12.965:761) : proctitle=/usr/bin/icecast -c /etc/icecast.xml
type=PATH msg=audit(01/27/2023 10:26:12.965:761) : item=0 name=/run/systemd/userdb/io.systemd.DynamicUser inode=38 dev=00:18 mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD msg=audit(01/27/2023 10:26:12.965:761) : cwd=/
type=SOCKADDR msg=audit(01/27/2023 10:26:12.965:761) : saddr={ saddr_fam=local path=/run/systemd/userdb/io.systemd.DynamicUser }
type=SYSCALL msg=audit(01/27/2023 10:26:12.965:761) : arch=x86_64 syscall=connect success=no exit=EACCES(Permission denied) a0=0x9 a1=0x7ffee89cd7e0 a2=0x2d a3=0x559f38f60bc0 items=1 ppid=1 pid=5336 auid=unset uid=root gid=icecast euid=root suid=root fsuid=root egid=icecast sgid=icecast fsgid=icecast tty=(none) ses=unset comm=icecast exe=/usr/bin/icecast subj=system_u:system_r:icecast_t:s0 key=(null)
type=AVC msg=audit(01/27/2023 10:26:12.965:761) : avc:  denied  { connectto } for  pid=5336 comm=icecast path=/run/systemd/userdb/io.systemd.DynamicUser scontext=system_u:system_r:icecast_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=unix_stream_socket permissive=0

FEDORA-2023-9323895447 has been submitted as an update to Fedora 36. https://bodhi.fedoraproject.org/updates/FEDORA-2023-9323895447

FEDORA-2023-9323895447 has been pushed to the Fedora 36 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2023-9323895447`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2023-9323895447

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

FEDORA-2023-9323895447 has been pushed to the Fedora 36 stable repository.
If problem still persists, please make note of it in this bug report.