Bug 1502085 - logrotate permission denied under systemd with selinux
Summary: logrotate permission denied under systemd with selinux
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: logrotate
Version: rawhide
Hardware: All
OS: Linux
unspecified
low
Target Milestone: ---
Assignee: Kamil Dudka
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-10-14 01:51 UTC by Axel Ulrich
Modified: 2018-12-04 15:55 UTC (History)
2 users (show)

Fixed In Version: logrotate-3.15.0-1.fc30
Clone Of:
Environment:
Last Closed: 2018-12-04 15:55:33 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Bugzilla 1655153 0 unspecified CLOSED logrotate should use systemd timer unit instead of cron.daily 2022-02-04 11:55:53 UTC

Internal Links: 1655153

Description Axel Ulrich 2017-10-14 01:51:15 UTC
I had created a systemd service + timer to run logrotate as a systemd service instead of logrotate running as a daily cron.  I did that under F25.
Now I don't look daily at errors, so I am not sure when it broke, but I am on F27 now and running lograte as a systemd service is not working.
It is a permission denied problem with selinux set to enforce.

The ultimate error line in the journal log is:
audit[11072]: AVC avc:  denied  { execute } for  pid=11072 comm="(ogrotate)" name="logrotate" dev="vda1" ino=10090 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:logrotate_exec_t:s0 tclass=file permissive=0

To fix, I wrote a selinux policy that allows it:

module systemd_logrotate 0.0.1;
require {
    type init_t;
    type logrotate_exec_t;
    type logrotate_t;
    class process transition;
    class file { execute getattr open read };
}
type_transition init_t logrotate_exec_t:process logrotate_t;
allow init_t logrotate_exec_t:file { execute getattr open read };
allow init_t logrotate_t:process transition;


Steps to Reproduce:
1. write a logrotate systemd service
/usr/local/lib/systemd/system/logrotate.service
contents of logrotate.service:
[Unit]
Description=rotate and compress system logs

[Service]
Type=oneshot
ExecStart=/usr/sbin/logrotate -s /var/lib/logrotate/logrotate.status /etc/logrotate.conf

2. Start the service
$ sudo systemctl start logrotate.service



Version-Release number of selected component (if applicable):
$ rpm -qa | egrep '(selinux|logrotate)'
rpm-plugin-selinux-4.14.0-0.rc2.3.fc27.x86_64
libselinux-python-2.7-2.fc27.x86_64
libselinux-python3-2.7-2.fc27.x86_64
selinux-policy-targeted-3.13.1-283.5.fc27.noarch
libselinux-2.7-2.fc27.x86_64
libselinux-devel-2.7-2.fc27.x86_64
logrotate-3.12.3-3.fc27.x86_64
libselinux-utils-2.7-2.fc27.x86_64
selinux-policy-3.13.1-283.5.fc27.noarch


So again, I am not sure if it qualifies as a bug, but it was working w/o me having to install a custom selinux policy before, but I am not sure when it broke.

Another question actually is, why logrotate is actually on a systemd system still installed as a daily cron and not as a systemd service + timer and with that would have to come with the proper selinux policy to run as a systemd service.

Comment 1 Kamil Dudka 2017-10-16 08:54:32 UTC
There are some systemd files maintained at logrotate upstream:

https://github.com/logrotate/logrotate/blob/master/examples/logrotate.service
https://github.com/logrotate/logrotate/blob/master/examples/logrotate.timer

I guess the reason why they are not used in Fedora is that the cron script has always worked perfectly.  So nobody cared to replace the working solution for questionable benefits.  I am just curious, what motivated you to use systemd instead of cron?

Comment 2 Axel Ulrich 2017-10-17 00:40:56 UTC
What motivated me is, that I had a few other jobs that run on a regular basis that I implemented as systemd timers taking advantage of features that cron doesn't have such as requires, after, ExecStartPost, etc., so I converted logrotate also.  So while those features may not be needed for logrotate, I think if systemd timers are really the replacement for cron, then a systemd system (workstation and server distro) could actually start out w/o cron (and w/o anacron).  I don't see anything other than logrotate in cron out of the box.  You are correct, logrotate via cron works fine, so this may become a philosophical discussion, but just because it works fine, doesn't mean it is not worth changing. 

logrotate does not depend on cronie ($ dnf repoquery --deplist logrotate) nor does cronie report it is required by logrotate ($ dnf repoquery --whatrequires cronie).  

Anyhow, I would opt for logrotate to start out with systemd timers instead of a daily cron on systemd systems like Fedora and while doing so install the proper SELinux policy to run under systemd, as it must have done at one point, as when I implemented logrotate as a systemd timer under F25, I did not have to add a SELinux policy.  logrotate must apparently assume that it will eventually run as a cron, as certainly the SELinux policy that allows it to run under cron daemon is there (transition, file execute and allowing the transition): 
$ sudo sesearch -s crond_t -t logrotate_exec_t -T -ds -dt
type_transition crond_t logrotate_exec_t:process logrotate_t;
$ sudo sesearch --allow -s crond_t -t logrotate_t -ds -dt
allow crond_t logrotate_t:process transition;
$ sudo sesearch --allow -s crond_t -t logrotate_exec_t -ds -dt
allow crond_t logrotate_exec_t:file { execute getattr open read };

So at least the SELinux policy that would allow logrotate to run as a systemd timer should be present, then the system admin can decide to run logrotate as a cron or systemd timer, and that decision would result in either configuring lograte as a cron using a proper crontab entry or cron.daily OR installing a systemd service+timer.

Comment 3 Kamil Dudka 2018-11-23 17:11:03 UTC
Sorry for being silent on this!  There is currently a pull-request (not initiated by me) to migrate logrotate from cron to systemd timer:

https://src.fedoraproject.org/rpms/logrotate/pull-request/1

Some compatibility/migration issues are currently being discussed.  Please feel free to join the discussion on the above pull-request.

Comment 4 Kamil Dudka 2018-12-04 15:55:33 UTC
downstream commit:

https://src.fedoraproject.org/rpms/logrotate/c/dadc24ae


Note You need to log in before you can comment on or make changes to this bug.