Bug 1669146 - rsyslog on controller node can't write haproxy log to /var/log/containers/haproxy
Summary: rsyslog on controller node can't write haproxy log to /var/log/containers/hap...
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: openstack-selinux
Version: 13.0 (Queens)
Hardware: Unspecified
OS: Unspecified
Target Milestone: z5
: 13.0 (Queens)
Assignee: Julie Pichon
QA Contact: Jon Schlueter
Depends On:
Blocks: 1600865 1672940
TreeView+ depends on / blocked
Reported: 2019-01-24 12:57 UTC by Damien Ciabrini
Modified: 2019-03-14 13:34 UTC (History)
5 users (show)

Fixed In Version: openstack-selinux-0.8.17-1.el7ost
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1671792 (view as bug list)
Last Closed: 2019-03-14 13:34:20 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Github redhat-openstack openstack-selinux pull 20 0 None closed Allow ryslog to write in container_file_t context 2020-12-09 04:48:12 UTC
Red Hat Product Errata RHSA-2019:0564 0 None None None 2019-03-14 13:34:27 UTC

Description Damien Ciabrini 2019-01-24 12:57:48 UTC
Description of problem:
In OpenStack, in order to make a containerized haproxy log into a file, one must use rsyslog on the host and write a dedicated config file to log into /var/log/containers/haproxy/

For our OpenStack deployment, the location for all logs is in /var/log/containers/, and the parent directory /var/log/containers is mounted with ":rw,z" flag by the crontab container, meaning all the content will see its context switched to container_file_t.

This context currently prevents rsyslog writing haproxy logs in the standard
location /var/log/containers/haproxy.

A fix is available upstream [1] to allow writing to such location.

[1] https://github.com/redhat-openstack/openstack-selinux/pull/20

How reproducible:

Steps to Reproduce:
1. Enable SELinux and deploy OSP13 with https://review.openstack.org/620601

Actual results:
logs can't be written to the expected location

Expected results:
logs should be written to expected location

Additional info:
The PR mentionned above has been merged upstream

Comment 1 Keigo Noha 2019-01-30 01:01:17 UTC
Hi Julie,

Is it possible to merge the fix into RHOSP13z5?

Keigo Noha

Comment 2 Julie Pichon 2019-01-30 18:05:10 UTC
I am currently looking into this. I am not sure if this will be in z5, I will update when I find out.

Comment 17 errata-xmlrpc 2019-03-14 13:34:20 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.