Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem: In RHEL 7, pacemaker's log (/var/log/pacemaker.log*) got labeled as cluster_var_log_t, with the exception of /var/log/pacemaker/bundles, which got labeled as var_log_t so that pacemaker-launched containers could write their /var/log which was mounted from there. (See Bug 1508360.)
In RHEL 8, pacemaker's log is now /var/log/pacemaker/pacemaker.log*, which gets var_log_t, and containers apparently are no longer allowed access to var_log_t. This is a regression in behavior from the fix for Bug 1508360.
Version-Release number of selected component (if applicable): 3.14.3-4.el8
Actual results: Pacemaker-launched containers are no longer able to access their /var/log mount.
Expected results: Pacemaker-launched containers are able to write or append to their usual logs under their /var/log mount (possibly including creating a subdirectory).
Additional info: It makes sense to label /var/log/pacemaker with cluster_var_log_t, comparable to /var/log/cluster, though I am not sure what applications actually make use of that label or whether it is important. However container_t seems to no longer be able to write to var_log_t, so I am not sure how /var/log/pacemaker/bundles should be labeled now.
One possibility would be to remove the exception for /var/log/pacemaker/bundles, so that it gets cluster_var_log_t, and allow container_t to write to that. A similar approach is taken by OpenStack (see https://github.com/redhat-openstack/openstack-selinux/pull/31 ), so this would simply make that a general policy. However I could see an argument for being more restrictive.
Another possibility would be to label /var/log/pacemaker/bundles with some existing label that container_t is already allowed access to, or to create a new label for the purpose.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHBA-2019:3547