Fedora Account System
Red Hat Associate
Red Hat Customer
I had created a systemd service + timer to run logrotate as a systemd service instead of logrotate running as a daily cron. I did that under F25. Now I don't look daily at errors, so I am not sure when it broke, but I am on F27 now and running lograte as a systemd service is not working. It is a permission denied problem with selinux set to enforce. The ultimate error line in the journal log is: audit[11072]: AVC avc: denied { execute } for pid=11072 comm="(ogrotate)" name="logrotate" dev="vda1" ino=10090 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:logrotate_exec_t:s0 tclass=file permissive=0 To fix, I wrote a selinux policy that allows it: module systemd_logrotate 0.0.1; require { type init_t; type logrotate_exec_t; type logrotate_t; class process transition; class file { execute getattr open read }; } type_transition init_t logrotate_exec_t:process logrotate_t; allow init_t logrotate_exec_t:file { execute getattr open read }; allow init_t logrotate_t:process transition; Steps to Reproduce: 1. write a logrotate systemd service /usr/local/lib/systemd/system/logrotate.service contents of logrotate.service: [Unit] Description=rotate and compress system logs [Service] Type=oneshot ExecStart=/usr/sbin/logrotate -s /var/lib/logrotate/logrotate.status /etc/logrotate.conf 2. Start the service $ sudo systemctl start logrotate.service Version-Release number of selected component (if applicable): $ rpm -qa | egrep '(selinux|logrotate)' rpm-plugin-selinux-4.14.0-0.rc2.3.fc27.x86_64 libselinux-python-2.7-2.fc27.x86_64 libselinux-python3-2.7-2.fc27.x86_64 selinux-policy-targeted-3.13.1-283.5.fc27.noarch libselinux-2.7-2.fc27.x86_64 libselinux-devel-2.7-2.fc27.x86_64 logrotate-3.12.3-3.fc27.x86_64 libselinux-utils-2.7-2.fc27.x86_64 selinux-policy-3.13.1-283.5.fc27.noarch So again, I am not sure if it qualifies as a bug, but it was working w/o me having to install a custom selinux policy before, but I am not sure when it broke. Another question actually is, why logrotate is actually on a systemd system still installed as a daily cron and not as a systemd service + timer and with that would have to come with the proper selinux policy to run as a systemd service.
There are some systemd files maintained at logrotate upstream: https://github.com/logrotate/logrotate/blob/master/examples/logrotate.service https://github.com/logrotate/logrotate/blob/master/examples/logrotate.timer I guess the reason why they are not used in Fedora is that the cron script has always worked perfectly. So nobody cared to replace the working solution for questionable benefits. I am just curious, what motivated you to use systemd instead of cron?
What motivated me is, that I had a few other jobs that run on a regular basis that I implemented as systemd timers taking advantage of features that cron doesn't have such as requires, after, ExecStartPost, etc., so I converted logrotate also. So while those features may not be needed for logrotate, I think if systemd timers are really the replacement for cron, then a systemd system (workstation and server distro) could actually start out w/o cron (and w/o anacron). I don't see anything other than logrotate in cron out of the box. You are correct, logrotate via cron works fine, so this may become a philosophical discussion, but just because it works fine, doesn't mean it is not worth changing. logrotate does not depend on cronie ($ dnf repoquery --deplist logrotate) nor does cronie report it is required by logrotate ($ dnf repoquery --whatrequires cronie). Anyhow, I would opt for logrotate to start out with systemd timers instead of a daily cron on systemd systems like Fedora and while doing so install the proper SELinux policy to run under systemd, as it must have done at one point, as when I implemented logrotate as a systemd timer under F25, I did not have to add a SELinux policy. logrotate must apparently assume that it will eventually run as a cron, as certainly the SELinux policy that allows it to run under cron daemon is there (transition, file execute and allowing the transition): $ sudo sesearch -s crond_t -t logrotate_exec_t -T -ds -dt type_transition crond_t logrotate_exec_t:process logrotate_t; $ sudo sesearch --allow -s crond_t -t logrotate_t -ds -dt allow crond_t logrotate_t:process transition; $ sudo sesearch --allow -s crond_t -t logrotate_exec_t -ds -dt allow crond_t logrotate_exec_t:file { execute getattr open read }; So at least the SELinux policy that would allow logrotate to run as a systemd timer should be present, then the system admin can decide to run logrotate as a cron or systemd timer, and that decision would result in either configuring lograte as a cron using a proper crontab entry or cron.daily OR installing a systemd service+timer.
Sorry for being silent on this! There is currently a pull-request (not initiated by me) to migrate logrotate from cron to systemd timer: https://src.fedoraproject.org/rpms/logrotate/pull-request/1 Some compatibility/migration issues are currently being discussed. Please feel free to join the discussion on the above pull-request.
downstream commit: https://src.fedoraproject.org/rpms/logrotate/c/dadc24ae