1446991 – Group ownership mismatch among journald directories and system.journal under them

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1446991 - Group ownership mismatch among journald directories and system.journal under them

Summary: Group ownership mismatch among journald directories and system.journal under ...

Keywords:
Status:	CLOSED DUPLICATE of bug 1411199
Alias:	None
Product:	Red Hat Enterprise Linux 7
Classification:	Red Hat
Component:	systemd
Sub Component:
Version:	7.3
Hardware:	Unspecified
OS:	Unspecified
Priority:	unspecified
Severity:	unspecified
Target Milestone:	rc
Target Release:	---
Assignee:	systemd-maint
QA Contact:	qe-baseos-daemons
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+	depends on / blocked

Reported:	2017-05-01 05:50 UTC by Noriko Hosoi
Modified:	2017-05-15 12:00 UTC (History)
CC List:	4 users (show)
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:	2017-05-15 12:00:09 UTC
Target Upstream Version:
Embargoed:

Attachments	(Terms of Use)

Description Noriko Hosoi 2017-05-01 05:50:04 UTC

Description of problem:
Not sure if it is a bug of not. If someone could enlighten me, I'd appreciate it.

Steps to reproduce.
Run the origin-aggregated-logging CI test using vagrant or oslab.
SSH to the installed host with vagrant ssh or ssh. 

Check the owner of the log dirs/files:
$ sudo ls -lR /run/log/journal
/run/log/journal:
total 0
drwxr-x---. 2 root root            60 Apr 30 21:17 01d028a8f770475ea42e6fb6615b5648
drwxr-s---+ 2 root systemd-journal 60 Apr 30 21:18 f9370ed252a14f73b014c1301a9b6d1b

/run/log/journal/01d028a8f770475ea42e6fb6615b5648:
total 8192
-rw-r-----. 1 root root 8388608 Apr 30 21:17 system.journal

/run/log/journal/f9370ed252a14f73b014c1301a9b6d1b:
total 8192
-rwxr-x---+ 1 root systemd-journal 8388608 Apr 30 21:34 system.journal

The directory 01d028a8f770475ea42e6fb6615b5648 and system.journal under the directory is owned by {root, root} instead of {root, systemd-journal}.

Here's the lsof output (it does not give useful info, though...)
$ sudo lsof /run/log/journal/01d028a8f770475ea42e6fb6615b5648/system.journal
COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
rsyslogd 910 root  mem    REG   0,19  8388608 1299 /run/log/journal/01d028a8f770475ea42e6fb6615b5648/system.journal
rsyslogd 910 root    6r   REG   0,19  8388608 1299 /run/log/journal/01d028a8f770475ea42e6fb6615b5648/system.journal

$ sudo lsof /run/log/journal/f9370ed252a14f73b014c1301a9b6d1b/system.journal
COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF  NODE NAME
systemd-j 416 root  mem    REG   0,19  8388608 11898 /run/log/journal/f9370ed252a14f73b014c1301a9b6d1b/system.journal
systemd-j 416 root   12u   REG   0,19  8388608 11898 /run/log/journal/f9370ed252a14f73b014c1301a9b6d1b/system.journal
rsyslogd  910 root  mem    REG   0,19  8388608 11898 /run/log/journal/f9370ed252a14f73b014c1301a9b6d1b/system.journal
rsyslogd  910 root    5r   REG   0,19  8388608 11898 /run/log/journal/f9370ed252a14f73b014c1301a9b6d1b/system.journal

The file system.journal with {root, root} ownership is likely a log for the installed remote host.  This is the snippet of the strings system.journal | grep "MESSAGE=".
MESSAGE=Runtime journal is using 8.0M (max allowed 378.3M, trying to leave 567.4M free of 3.6G available
MESSAGE=Initializing cgroup subsys cpuset
MESSAGE=Initializing cgroup subsys cpu
MESSAGE=Initializing cgroup subsys cpuacct
MESSAGE=Linux version 3.10.0-327.22.2.el7.x86_64 (mockbuild.eng.bos.redhat.com) (gcc version 4.8.5 20150623 (Red Hat 4.8.5-4) (GCC) ) #1 SMP Thu Jun 9 10:09:10 EDT 2016
MESSAGE=Command line: BOOT_IMAGE=/boot/vmlinuz-3.10.0-327.22.2.el7.x86_64 root=UUID=6785eb86-c596-4229-85fb-4d30c848c6e8 ro crashkernel=auto console=ttyS0,115200n8 console=tty0 LANG=en_US.UTF-8
MESSAGE=e820: BIOS-provided physical RAM map:
MESSAGE=BIOS-e820: [mem 0x0000000000000000-0x000000000009dfff] usable
MESSAGE=BIOS-e820: [mem 0x000000000009e000-0x000000000009ffff] reserved

My question would be whether there is a policy on the ownership of the directory and the files or not.

Please note: fluentd runs as a privileged container, so there should not be a problem for the logging system.

Comment 2 Jan Synacek 2017-05-15 12:00:09 UTC


*** This bug has been marked as a duplicate of bug 1411199 ***

Note You need to log in before you can comment on or make changes to this bug.