Bug 1089371 - SELinux denies access to /var/log/horizon/horizon.log
Summary: SELinux denies access to /var/log/horizon/horizon.log
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: rawhide
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: 1104609
TreeView+ depends on / blocked
 
Reported: 2014-04-18 14:51 UTC by Matthias Runge
Modified: 2014-11-07 13:27 UTC (History)
10 users (show)

Fixed In Version: selinux-policy-3.13.1-56.fc21
Clone Of:
: 1104609 (view as bug list)
Environment:
Last Closed: 2014-05-30 12:40:17 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Matthias Runge 2014-04-18 14:51:25 UTC
[Fri Apr 18 14:47:32.267046 2014] [:error] [pid 1470] [remote ::1:11094] ValueError: Unable to configure handler 'file': [Errno 13] Permission denied: '/var/log/horizon/horizon.log'
^C
[root@sofja ~]# ls -lZ /var/log/httpd/access_log
-rw-r--r--. root root system_u:object_r:httpd_log_t:s0 /var/log/httpd/access_log
[root@sofja ~]# ls -lZ /var/log/horizon/horizon.log 
-rw-r--r--. apache apache system_u:object_r:var_log_t:s0   /var/log/horizon/horizon.log

Comment 1 Miroslav Grepl 2014-05-21 09:44:52 UTC
How is /var/log/horizon/horizon.log created?

# rpm -qf /var/log/horizon

If you execute

# chcon -R -t httpd_log_t /var/log/horizon

does it fix the issue?

Comment 2 Matthias Runge 2014-05-22 07:03:13 UTC
It's created by httpd due configuration of openstack-dashboard.

[root@turing ~]# rpm -qf /var/log/horizon/
openstack-dashboard-2014.1-1.fc21.noarch

After chcon, it looks like the issue is fixed.

Comment 3 Daniel Walsh 2014-05-25 10:39:45 UTC
8414e1aef6778718c4b4101e033abe5006ee65d5 fixes this in git.

Comment 4 Matthias Runge 2014-06-02 14:20:00 UTC
Thank you for fixing and building the package. Is it possible, to get this backported to f20 as well, as we have folks running OpenStack packages from Rawhide on F20 (via RDO repository, that's a pretty common pattern)

Comment 5 Lukas Vrabec 2014-11-07 13:27:08 UTC
commit 52921ed8636a9bffc77cca1b9efd9a9abb40368a
Author: Dan Walsh <dwalsh>
Date:   Sun May 25 06:39:21 2014 -0400

    Label /var/log/horizon as an apache log


back ported to f20.


Note You need to log in before you can comment on or make changes to this bug.