Bug 872345
| Summary: | AWStats SELinux module lacks tunable for PurgeLogFile=1 setup | |||
|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Dmitry S. Makovey <dmitry> | |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> | |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | |
| Severity: | unspecified | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | 17 | CC: | dominick.grift, dwalsh, mgrepl, plautrba, rpm | |
| Target Milestone: | --- | |||
| Target Release: | --- | |||
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | Doc Type: | Bug Fix | ||
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 872542 (view as bug list) | Environment: | ||
| Last Closed: | 2013-01-07 04:00:19 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 872542 | |||
The awstats itself shouldn't provide any SELinux module. However, some SELinux boolean, which would allow awstats to purge logs, might be usable. Yeap. Also we don't want to allow it by default. How about "awstats_purge_apache_log" boolean as you suggest. sounds great (and logical) to me :) Added.
commit 29865a1bb8feeaafd0875821684d593c1b12a7d0
Author: Miroslav Grepl <mgrepl>
Date: Mon Nov 26 16:29:33 2012 +0100
Add awstats_purge_apache_log boolean
selinux-policy-3.10.0-165.fc17 has been submitted as an update for Fedora 17. https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-165.fc17 Package selinux-policy-3.10.0-165.fc17: * should fix your issue, * was pushed to the Fedora 17 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.10.0-165.fc17' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2012-20544/selinux-policy-3.10.0-165.fc17 then log in and leave karma (feedback). Package selinux-policy-3.10.0-166.fc17: * should fix your issue, * was pushed to the Fedora 17 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.10.0-166.fc17' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2012-20544/selinux-policy-3.10.0-166.fc17 then log in and leave karma (feedback). selinux-policy-3.10.0-166.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report. |
Description of problem: Currently if SELinux enabled on Fedora 16+ or RHEL6 and awstats installed (via EPEL for RHEL) - enabling "PurgeLogFile=1" option creates SELinux denials. Version-Release number of selected component (if applicable): RHEL: awstats-7.0-2.el6.noarch selinux-policy-3.7.19-155.el6_3.4.noarch selinux-policy-targeted-3.7.19-155.el6_3.4.noarch F16: awstats-7.0-6.fc16.noarch selinux-policy-3.10.0-91.fc16.noarch selinux-policy-targeted-3.10.0-91.fc16.noarch How reproducible: always Steps to Reproduce: 1. install Fedora/RHEL+EPEL 2. enable SELinux 3. install awstats 4. configure awstats to purge httpd log files: PurgeLogFile=1 Actual results: type=AVC msg=audit(1349467262.084:790): avc: denied { write } for pid=7413 comm="awstats.pl" name="moodle22-access_log" dev=dm-6 ino=39 scontext=system_u:system_r:awstats_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:httpd_log_t:s0 tclass=file and un-purged files. Expected results: files processed by awstats and logfiles purged after processing. Additional info: I have "fixed" it locally by building additional SELinux policy module: module awstats-httpd-logs 1.1; require { type httpd_log_t; type awstats_t; class file write; } #============= awstats_t ============== allow awstats_t httpd_log_t:file write; however I believe it should be part of base awstats module with a tunable boolean switching on/off behavior with default to "off".