Red Hat Bugzilla – Bug 1278076
Log rotate generates SELinux permission errors
Last modified: 2015-12-08 08:44:08 EST
Description of problem: During log rotate the file at /opt/rh/cfme-gemset/enable gets sourced. This file attempts to link and remove files that the logrotate_t context cannot touch. These errors generate mail to /var/spool/mail/root. Before https://bugzilla.redhat.com/show_bug.cgi?id=1265463 was resolved, log rotate would fail because the source of /etc/default/evm would exit with an error status. This may be a more widespread issue with services which do not have privileges to touch the files referenced in /opt/rh/cfme-gemset/enable The ideal solution would be to keep operations in files sourced by /etc/default/evm limited to setting environment variables and move operations which require specific privileges to other scripts which are only called by the processes which actually need them to be run. Version-Release number of selected component (if applicable): 5.5.0.9-2 How reproducible: Always Steps to Reproduce: 1.Allow logrotate to run (daily) 2.Examine mail in /var/spool/mail/root 3. Actual results: Many errors Expected results: No mail is sent by log rotate as a result of sourcing /etc/default/evm Additional info: Errors seen in /var/spool/mail/root: From root@localhost.localdomain.localdomain Wed Nov 4 03:46:52 2015 Return-Path: <root@localhost.localdomain.localdomain> X-Original-To: root Delivered-To: root@localhost.localdomain.localdomain Received: by localhost.localdomain.localdomain (Postfix, from userid 0) id 9A2D327561; Wed, 4 Nov 2015 03:46:51 -0500 (EST) From: Anacron <root@localhost.localdomain.localdomain> To: root@localhost.localdomain.localdomain Content-Type: text/plain; charset="UTF-8" Subject: Anacron job 'cron.daily' on localhost.localdomain.localdomain Message-Id: <20151104084651.9A2D327561@localhost.localdomain.localdomain> Date: Wed, 4 Nov 2015 03:46:51 -0500 (EST) /etc/cron.daily/logrotate: rm: cannot remove ‘/var/www/miq/vmdb/Gemfile.lock’: Permission denied ln: failed to create symbolic link ‘/var/www/miq/vmdb/Gemfile.lock’: File exists rm: cannot remove ‘/var/www/miq/vmdb/.bundle’: Permission denied ln: failed to create symbolic link ‘/var/www/miq/vmdb/.bundle/.bundle’: Permission denied rm: cannot remove ‘/var/www/miq/vmdb/bin’: Permission denied cp: cannot create directory ‘/var/www/miq/vmdb/bin/bin’: Permission denied rm: cannot remove ‘/var/www/miq/vmdb/Gemfile.lock’: Permission denied ln: failed to create symbolic link ‘/var/www/miq/vmdb/Gemfile.lock’: File exists rm: cannot remove ‘/var/www/miq/vmdb/.bundle’: Permission denied ln: failed to create symbolic link ‘/var/www/miq/vmdb/.bundle/.bundle’: Permission denied rm: cannot remove ‘/var/www/miq/vmdb/bin’: Permission denied cp: cannot create directory ‘/var/www/miq/vmdb/bin/bin’: Permission denied
Related to BZ1278202 Fixed in our cfme-gemset RPM spec by separating the parts of the enable script that are really for one-time setup into a setup script, and calling the setup script from the kickstart. http://pkgs.devel.redhat.com/cgit/rpms/cfme-gemset/commit/?h=cfme-rh-ruby22-5.5-rhel-7&id=1786f29bfbd65ad2306a993b6c9d2fb467fb9cf8 http://pkgs.devel.redhat.com/cgit/rpms/cfme-appliance/commit/?h=cfme-5.5-rhel-7&id=68780064a4dd1259a35d3794a16cd05ac0a32111
I got no e-mails with errors on 5.5.0.11. /var/log/cron shows that logrotate has run.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2015:2551