Bug 477860

Actually the labeling might be wrong on these files since the confined domains really should not be able to write to these compressed files any longer they should be just labeled var_log_t.  But then again perhaps this would allow  a confined domain to read these files where before they were not allowed.  How do you get logrotate to create these compressed files?


We probably need to make logrote SELinux aware to get the behaviour you suggest.  It would need to call matchpathcon and find out the proper label of the file it is creating and then create the file with the right context.

(In reply to comment #1)
> Actually the labeling might be wrong on these files since the confined domains
> really should not be able to write to these compressed files any longer they
> should be just labeled var_log_t.  But then again perhaps this would allow  a
> confined domain to read these files where before they were not allowed.  How do
> you get logrotate to create these compressed files?
> 

There is /etc/logrotate.d/proftpd owned by proftpd-1.3.1-6.fc10 that contains these lines:

+-------------------------------------------+
/var/log/proftpd.log /var/log/xferlog {
    compress
    missingok
    notifempty
    sharedscripts
    postrotate
        test -f /var/lock/subsys/proftpd && /usr/bin/killall -HUP proftpd || :
    endscript
}
+-------------------------------------------+

> We probably need to make logrote SELinux aware to get the behaviour you
> suggest.  It would need to call matchpathcon and find out the proper label of
> the file it is creating and then create the file with the right context.

Yeah, that's could be the best solution right now. Let me know if you need me to attach there any other config file or test something.

/etc/logrotate.d/rpm is instead owned by rpm-4.6.0-0.rc1.8 and contains:

+------------------------------------------------+
/var/log/rpmpkgs {
    weekly
    notifempty
    missingok
}
+------------------------------------------------+

logrotate should be maintaining the file context on the files that it rotates and compresses.

hello Gianluca, I am not able to reproduce the problem: I installed proftpd and created /var/log/xferlog, but the gzipped files from running logrotate have the proper, xferlog_t , context... is there a simple way to reproduce the bug?

Hi Daniel,

I'll try to reproduce the problem in a new F10 system and will let you know the results.

hello Gianluca,
bump: is this still a problem now, using latest selinux-policy update?

Daniel,

It seems OK now! compressed files now have all the same file context.

-rw-r-----  root   root    system_u:object_r:var_log_t:s0   proftpd.log
-rw-r-----  root   root    system_u:object_r:var_log_t:s0   proftpd.log-20090329.gz
-rw-r-----  root   root    system_u:object_r:var_log_t:s0   proftpd.log-20090330.gz
-rw-r-----  root   root    system_u:object_r:var_log_t:s0   proftpd.log-20090331.gz

-rw-r--r--  root   root    system_u:object_r:cron_log_t:s0  rpmpkgs
-rw-r--r--  root   root    system_u:object_r:cron_log_t:s0  rpmpkgs-20090315.gz
-rw-r--r--  root   root    system_u:object_r:cron_log_t:s0  rpmpkgs-20090322.gz
-rw-r--r--  root   root    system_u:object_r:cron_log_t:s0  rpmpkgs-20090329.gz


-rw-r--r--  root   root    system_u:object_r:xferlog_t:s0   xferlog
-rw-r--r--  root   root    system_u:object_r:xferlog_t:s0   xferlog-20090329.gz
-rw-r--r--  root   root    system_u:object_r:xferlog_t:s0   xferlog-20090330.gz
-rw-r--r--  root   root    system_u:object_r:xferlog_t:s0   xferlog-20090331.gz

Thanks for your prompt help! ;-)

OK, thanks for your report, closing