Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1446991

Summary: Group ownership mismatch among journald directories and system.journal under them
Product: Red Hat Enterprise Linux 7 Reporter: Noriko Hosoi <nhosoi>
Component: systemdAssignee: systemd-maint
Status: CLOSED DUPLICATE QA Contact: qe-baseos-daemons
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 7.3CC: aos-bugs, jsynacek, pportant, systemd-maint-list
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-05-15 12:00:09 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Noriko Hosoi 2017-05-01 05:50:04 UTC
Description of problem:
Not sure if it is a bug of not. If someone could enlighten me, I'd appreciate it.

Steps to reproduce.
Run the origin-aggregated-logging CI test using vagrant or oslab.
SSH to the installed host with vagrant ssh or ssh. 

Check the owner of the log dirs/files:
$ sudo ls -lR /run/log/journal
/run/log/journal:
total 0
drwxr-x---. 2 root root            60 Apr 30 21:17 01d028a8f770475ea42e6fb6615b5648
drwxr-s---+ 2 root systemd-journal 60 Apr 30 21:18 f9370ed252a14f73b014c1301a9b6d1b

/run/log/journal/01d028a8f770475ea42e6fb6615b5648:
total 8192
-rw-r-----. 1 root root 8388608 Apr 30 21:17 system.journal

/run/log/journal/f9370ed252a14f73b014c1301a9b6d1b:
total 8192
-rwxr-x---+ 1 root systemd-journal 8388608 Apr 30 21:34 system.journal

The directory 01d028a8f770475ea42e6fb6615b5648 and system.journal under the directory is owned by {root, root} instead of {root, systemd-journal}.

Here's the lsof output (it does not give useful info, though...)
$ sudo lsof /run/log/journal/01d028a8f770475ea42e6fb6615b5648/system.journal
COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
rsyslogd 910 root  mem    REG   0,19  8388608 1299 /run/log/journal/01d028a8f770475ea42e6fb6615b5648/system.journal
rsyslogd 910 root    6r   REG   0,19  8388608 1299 /run/log/journal/01d028a8f770475ea42e6fb6615b5648/system.journal

$ sudo lsof /run/log/journal/f9370ed252a14f73b014c1301a9b6d1b/system.journal
COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF  NODE NAME
systemd-j 416 root  mem    REG   0,19  8388608 11898 /run/log/journal/f9370ed252a14f73b014c1301a9b6d1b/system.journal
systemd-j 416 root   12u   REG   0,19  8388608 11898 /run/log/journal/f9370ed252a14f73b014c1301a9b6d1b/system.journal
rsyslogd  910 root  mem    REG   0,19  8388608 11898 /run/log/journal/f9370ed252a14f73b014c1301a9b6d1b/system.journal
rsyslogd  910 root    5r   REG   0,19  8388608 11898 /run/log/journal/f9370ed252a14f73b014c1301a9b6d1b/system.journal

The file system.journal with {root, root} ownership is likely a log for the installed remote host.  This is the snippet of the strings system.journal | grep "MESSAGE=".
MESSAGE=Runtime journal is using 8.0M (max allowed 378.3M, trying to leave 567.4M free of 3.6G available
MESSAGE=Initializing cgroup subsys cpuset
MESSAGE=Initializing cgroup subsys cpu
MESSAGE=Initializing cgroup subsys cpuacct
MESSAGE=Linux version 3.10.0-327.22.2.el7.x86_64 (mockbuild.eng.bos.redhat.com) (gcc version 4.8.5 20150623 (Red Hat 4.8.5-4) (GCC) ) #1 SMP Thu Jun 9 10:09:10 EDT 2016
MESSAGE=Command line: BOOT_IMAGE=/boot/vmlinuz-3.10.0-327.22.2.el7.x86_64 root=UUID=6785eb86-c596-4229-85fb-4d30c848c6e8 ro crashkernel=auto console=ttyS0,115200n8 console=tty0 LANG=en_US.UTF-8
MESSAGE=e820: BIOS-provided physical RAM map:
MESSAGE=BIOS-e820: [mem 0x0000000000000000-0x000000000009dfff] usable
MESSAGE=BIOS-e820: [mem 0x000000000009e000-0x000000000009ffff] reserved

My question would be whether there is a policy on the ownership of the directory and the files or not.

Please note: fluentd runs as a privileged container, so there should not be a problem for the logging system.

Comment 2 Jan Synacek 2017-05-15 12:00:09 UTC

*** This bug has been marked as a duplicate of bug 1411199 ***