Bug 878757

Summary:

allow logrotate_t to list_dir/read_file of admin_home_t

Product:

Red Hat Enterprise Linux 6

Reporter:

Jan Kaluža <jkaluza>

Component:

selinux-policy

Assignee:

Miroslav Grepl <mgrepl>

Status:

CLOSED WONTFIX

QA Contact:

Milos Malik <mmalik>

Severity:

unspecified

Docs Contact:

Priority:

unspecified

Version:

6.4

CC:

dwalsh, mmalik

Target Milestone:

Target Release:

---

Hardware:

All

OS:

Linux

Whiteboard:

Fixed In Version:

Doc Type:

Bug Fix

Doc Text:

Story Points:

---

Clone Of:

Environment:

Last Closed:

2013-01-15 09:02:54 UTC

Type:

Bug

Regression:

---

Mount Type:

---

Documentation:

---

CRM:

Verified Versions:

Category:

---

oVirt Team:

---

RHEL 7.3 requirements from Atomic Host:

Cloudforms Team:

---

Target Upstream Version:

Embargoed:

Bug Depends On:

Bug Blocks:

878032

Attachments:

Description	Flags
audit.txt	none

Description Jan Kaluža 2012-11-21 07:22:20 UTC

Hi,

I'm opening this bug as reaction to Bug 878032.

> The second problem is that under RHEL6, /root/* has an SELinux Label of
> admin_home_t whereas it had a Label of user_home_t under RHEL5. The
> side-effect is that logrotate_t has no read permissions to /root/* under
> RHEL6, even though it did under RHEL5. Consequently we added this permission
> to get our particular logrotate script working:
> 
> allow logrotate_t admin_home_t:dir { list_dir_perms };
> allow logrotate_t admin_home_t:file { read_file_perms };
> 
> Is it reasonable to add this permission to RHEL6?

Comment 3 Daniel Walsh 2012-11-21 14:14:07 UTC

Why are log files in /root?   But I have no problem allowing this.

Comment 4 Jan Kaluža 2012-11-22 06:46:49 UTC

I see what you mean, we probably have to make some decision where the log files can be and where not. I don't know why the reporter has log files in /root, but it used to work in RHEL5 and we should presume people were doing this.

Comment 5 RHEL Program Management 2012-12-14 08:16:57 UTC

This request was not resolved in time for the current release.
Red Hat invites you to ask your support representative to
propose this request, if still desired, for consideration in
the next release of Red Hat Enterprise Linux.

Comment 6 Miroslav Grepl 2012-12-14 10:40:54 UTC

Any chance to test it with the lastest policy builds?

Comment 7 Milos Malik 2012-12-14 11:18:03 UTC

No problem.

Comment 8 Miroslav Grepl 2013-01-04 07:43:46 UTC

How does it look?

Comment 9 Jan Kaluža 2013-01-04 08:08:02 UTC

Hm, sorry for delay, I though Milos comment meant he will test it. I can do it myself. What selinux-policy release should I use?

Comment 10 Miroslav Grepl 2013-01-04 08:28:49 UTC

With the latest -189.el6. Thank you.

Comment 11 Jan Kaluža 2013-01-08 08:26:47 UTC

I have installed selinux-policy 3.7.19-191.el6 (I presume it should be fixed in this version too), but it does not work. I'm attaching part of audit log with the AVC.

Comment 12 Jan Kaluža 2013-01-08 08:28:12 UTC

Created attachment 674590 [details]
audit.txt

Comment 13 Miroslav Grepl 2013-01-08 09:33:52 UTC

Ok, I see we just added

> allow logrotate_t admin_home_t:dir { list_dir_perms };


These AVC are about file class.

Comment 14 Jan Kaluža 2013-01-14 10:53:41 UTC

So is there any new package I should try? selinux-policy-3.7.19-192.el6 changelog does not mention this.

Comment 15 Milos Malik 2013-01-14 11:08:50 UTC

selinux-policy-3.7.19-192.el6 contains allow rules you need, please give it a try.

# sesearch -s logrotate_t -t admin_home_t -c file --allow -C
Found 1 semantic av rules:
   allow logrotate_t admin_home_t : file { ioctl read getattr lock open } ; 

# sesearch -s logrotate_t -t admin_home_t -c dir --allow -C
Found 2 semantic av rules:
   allow logrotate_t file_type : dir { getattr search open } ; 
   allow logrotate_t admin_home_t : dir { ioctl read getattr lock search open } 

#

Comment 16 Jan Kaluža 2013-01-15 08:32:47 UTC

I've talked with Miroslav about this and it looks it won't work until we grant logrotate "write" permission, but he thinks it's not good idea to do so. I think I've changed my opinion and I think we should declare that logrotate can rotate log files only in /var/log/ directory and not in /root. I would say having logs in /root directory is not standard anyway.

Feel free to close this bug and thanks you for your help.