Description of problem:
zaqar wsgi app unable to start after undercloud upgrade to RHOSP 12 due to the incorrect labelling of zaqar.log.

Version-Release number of selected component (if applicable):
puppet-zaqar-11.2.0-0.20170720174016.2308b45.el7ost.noarch

How reproducible:
Always

Steps to Reproduce:

- Deploy a RHEL 7.4 OSP 10 undercloud with SELinux set to enforcing :

# getenforce 
Enforcing

- Upgrade to RHOSP 11 :

# sudo rhos-release -x ; sudo rhos-release 11
# sudo systemctl stop openstack-* neutron-* httpd
# sudo yum -y update instack-undercloud openstack-puppet-modules openstack-tripleo-common python-tripleoclient
# openstack undercloud upgrade

- Upgrade to RHOSP 12 :

# sudo rhos-release -x ; sudo rhos-release 12
# sudo systemctl stop openstack-* neutron-* httpd
# sudo yum -y update instack-undercloud openstack-puppet-modules openstack-tripleo-common python-tripleoclient
# openstack undercloud upgrade

- Review the status of the zaqar wsgi app :

# systemctl status httpd
● httpd.service - The Apache HTTP Server
   Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; vendor preset: disabled)
   Active: active (running) since Wed 2017-08-02 07:29:50 EDT; 3min 20s ago
     Docs: man:httpd(8)
           man:apachectl(8)
 Main PID: 28880 (httpd)
   Status: "Total requests: 0; Current requests/sec: 0; Current traffic:   0 B/sec"
   CGroup: /system.slice/httpd.service
           ├─28880 /usr/sbin/httpd -DFOREGROUND
           ├─28881 heat_api_cfn_ws -DFOREGROUND
           ├─28882 heat_api_cfn_ws -DFOREGROUND
           ├─28883 heat_api_wsgi   -DFOREGROUND
           ├─28884 heat_api_wsgi   -DFOREGROUND
           ├─28885 ironic_wsgi     -DFOREGROUND
           ├─28886 keystone-admin  -DFOREGROUND
           ├─28887 keystone-main   -DFOREGROUND
           ├─28888 placement_wsgi  -DFOREGROUND
           ├─28889 zaqar_wsgi      -DFOREGROUND
           ├─28890 /usr/sbin/httpd -DFOREGROUND
           ├─28891 /usr/sbin/httpd -DFOREGROUND
           ├─28892 /usr/sbin/httpd -DFOREGROUND
           ├─28893 /usr/sbin/httpd -DFOREGROUND
           ├─28894 /usr/sbin/httpd -DFOREGROUND
           ├─28895 /usr/sbin/httpd -DFOREGROUND
           ├─28896 /usr/sbin/httpd -DFOREGROUND
           ├─28897 /usr/sbin/httpd -DFOREGROUND
           ├─28983 /usr/sbin/httpd -DFOREGROUND
           ├─30321 /usr/sbin/httpd -DFOREGROUND
           ├─30324 /usr/sbin/httpd -DFOREGROUND
           ├─30325 /usr/sbin/httpd -DFOREGROUND
           ├─30348 /usr/sbin/httpd -DFOREGROUND
           └─31510 /usr/sbin/httpd -DFOREGROUND

# sudo head -n20 /var/log/httpd/zaqar_wsgi_error.log
[Wed Aug 02 07:29:51.675853 2017] [:error] [pid 28889] [remote 192.168.24.1:212] mod_wsgi (pid=28889): Target WSGI script '/var/www/cgi-bin/zaqar/zaqar-server' cannot be loaded as Python module.
[Wed Aug 02 07:29:51.675910 2017] [:error] [pid 28889] [remote 192.168.24.1:212] mod_wsgi (pid=28889): Exception occurred processing WSGI script '/var/www/cgi-bin/zaqar/zaqar-server'.
[Wed Aug 02 07:29:51.675942 2017] [:error] [pid 28889] [remote 192.168.24.1:212] Traceback (most recent call last):
[Wed Aug 02 07:29:51.675961 2017] [:error] [pid 28889] [remote 192.168.24.1:212]   File "/var/www/cgi-bin/zaqar/zaqar-server", line 42, in <module>
[Wed Aug 02 07:29:51.676027 2017] [:error] [pid 28889] [remote 192.168.24.1:212]     log.setup(conf, 'zaqar')
[Wed Aug 02 07:29:51.676039 2017] [:error] [pid 28889] [remote 192.168.24.1:212]   File "/usr/lib/python2.7/site-packages/oslo_log/log.py", line 264, in setup
[Wed Aug 02 07:29:51.676176 2017] [:error] [pid 28889] [remote 192.168.24.1:212]     _setup_logging_from_conf(conf, product_name, version)
[Wed Aug 02 07:29:51.676188 2017] [:error] [pid 28889] [remote 192.168.24.1:212]   File "/usr/lib/python2.7/site-packages/oslo_log/log.py", line 353, in _setup_logging_from_conf
[Wed Aug 02 07:29:51.676206 2017] [:error] [pid 28889] [remote 192.168.24.1:212]     filelog = file_handler(logpath)
[Wed Aug 02 07:29:51.676217 2017] [:error] [pid 28889] [remote 192.168.24.1:212]   File "/usr/lib64/python2.7/logging/handlers.py", line 392, in __init__
[Wed Aug 02 07:29:51.687400 2017] [:error] [pid 28889] [remote 192.168.24.1:212]     logging.FileHandler.__init__(self, filename, mode, encoding, delay)
[Wed Aug 02 07:29:51.687423 2017] [:error] [pid 28889] [remote 192.168.24.1:212]   File "/usr/lib64/python2.7/logging/__init__.py", line 902, in __init__
[Wed Aug 02 07:29:51.693848 2017] [:error] [pid 28889] [remote 192.168.24.1:212]     StreamHandler.__init__(self, self._open())
[Wed Aug 02 07:29:51.693868 2017] [:error] [pid 28889] [remote 192.168.24.1:212]   File "/usr/lib64/python2.7/logging/__init__.py", line 925, in _open
[Wed Aug 02 07:29:51.693889 2017] [:error] [pid 28889] [remote 192.168.24.1:212]     stream = open(self.baseFilename, self.mode)
[Wed Aug 02 07:29:51.693915 2017] [:error] [pid 28889] [remote 192.168.24.1:212] IOError: [Errno 13] Permission denied: '/var/log/zaqar/zaqar.log'
[Wed Aug 02 07:29:53.697492 2017] [:error] [pid 28889] [remote 192.168.24.1:204] mod_wsgi (pid=28889): Target WSGI script '/var/www/cgi-bin/zaqar/zaqar-server' cannot be loaded as Python module.
[Wed Aug 02 07:29:53.697534 2017] [:error] [pid 28889] [remote 192.168.24.1:204] mod_wsgi (pid=28889): Exception occurred processing WSGI script '/var/www/cgi-bin/zaqar/zaqar-server'.
[Wed Aug 02 07:29:53.697558 2017] [:error] [pid 28889] [remote 192.168.24.1:204] Traceback (most recent call last):

# sudo grep zaqar\.log /var/log/audit/audit.log 
type=AVC msg=audit(1501673391.674:17232): avc:  denied  { open } for  pid=28889 comm="httpd" path="/var/log/zaqar/zaqar.log" dev="vda1" ino=92344168 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file

Actual results:
The Zaqar wsgi app is unable to start due to an EPERM error regarding its log file.

Expected results:
The Zaqar wsgi app is running correctly.

Additional info:
This hasn't been seen upstream as the undercloud-upgrades job run with SELinux in permissive mode :

http://logs.openstack.org/42/475442/3/check/gate-tripleo-ci-centos-7-undercloud-upgrades-nv/9b7a5bd/logs/etc/selinux/config.txt.gz