We need to back port also crond changes form the latest upstream cron fixes.

*** Bug 1298523 has been marked as a duplicate of this bug. ***

Also seen in RHCI 6.0 TP2 RC9
/etc/cron.daily/logrotate:

su: avc.c:74: avc_context_to_sid_raw: Assertion `avc_running' failed.
/usr/sbin/rabbitmqctl: line 44: 17441 Aborted                 su rabbitmq -s /bin/sh -c "/usr/lib/rabbitmq/bin/${SCRIPT} ${CMDLINE}"
error: error running shared postrotate script for '/var/log/rabbitmq/*.log '

type=SYSCALL msg=audit(1455438965.205:86034): arch=c000003e syscall=41 success=no exit=-13 a0=10 a1=80003 a2=7 a3=1 items=0 ppid=17430 pid=17441 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=48 comm="su" exe="/usr/bin/su" subj=system_u:system_r:logrotate_t:s0-s0:c0.c1023 key=(null)

Can we get this somehow forward, given there is a ticket on the Red Hat
customer portal?

It is going to be addressed in rhel-7.3.0.

Hi, 
Do you know why is logrotate trying to communicate with systemd-logind service via dbus? 

Thank you.

Isn't it the postrotate scriptlet for rabbitmq which is trying to talk to logind?

/usr/sbin/rabbitmqctl: line 44: 17441 Aborted                 su rabbitmq -s /bin/sh -c "/usr/lib/rabbitmq/bin/${SCRIPT} ${CMDLINE}"

... this comes from rabbitmq not logrotate.

I'm afraid this bug is not completely fixed. Some logrotate scripts run su and then su runs unix_chkpwd. Therefore you can see SELinux denials like:

----
type=USER_AVC msg=audit(08/04/2016 11:45:06.141:735) : pid=31279 uid=root auid=root ses=23 subj=system_u:system_r:logrotate_t:s0-s0:c0.c1023 msg='avc:  denied  { passwd } for  scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tclass=passwd  exe=/usr/bin/su sauid=root hostname=? addr=? terminal=?' 
----
type=PATH msg=audit(08/04/2016 11:45:06.143:736) : item=0 name=/etc/shadow inode=17847672 dev=fd:03 mode=file,000 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:shadow_t:s0 objtype=NORMAL 
type=CWD msg=audit(08/04/2016 11:45:06.143:736) :  cwd=/var/lib/rabbitmq 
type=SYSCALL msg=audit(08/04/2016 11:45:06.143:736) : arch=x86_64 syscall=open success=no exit=EACCES(Permission denied) a0=0x7f7d31b32453 a1=O_RDONLY|O_CLOEXEC a2=0x1b6 a3=0x24 items=1 ppid=31279 pid=31280 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=23 comm=unix_chkpwd exe=/usr/sbin/unix_chkpwd subj=system_u:system_r:logrotate_t:s0-s0:c0.c1023 key=(null) 
type=AVC msg=audit(08/04/2016 11:45:06.143:736) : avc:  denied  { read } for  pid=31280 comm=unix_chkpwd name=shadow dev="vda3" ino=17847672 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:shadow_t:s0 tclass=file 
----

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2283.html