Description of problem: In RHEL 7, pacemaker's log (/var/log/pacemaker.log*) got labeled as cluster_var_log_t, with the exception of /var/log/pacemaker/bundles, which got labeled as var_log_t so that pacemaker-launched containers could write their /var/log which was mounted from there. (See Bug 1508360.)

In RHEL 8, pacemaker's log is now /var/log/pacemaker/pacemaker.log*, which gets var_log_t, and containers apparently are no longer allowed access to var_log_t. This is a regression in behavior from the fix for Bug 1508360.


Version-Release number of selected component (if applicable): 3.14.3-4.el8


Actual results: Pacemaker-launched containers are no longer able to access their /var/log mount.


Expected results: Pacemaker-launched containers are able to write or append to their usual logs under their /var/log mount (possibly including creating a subdirectory).


Additional info: It makes sense to label /var/log/pacemaker with cluster_var_log_t, comparable to /var/log/cluster, though I am not sure what applications actually make use of that label or whether it is important. However container_t seems to no longer be able to write to var_log_t, so I am not sure how /var/log/pacemaker/bundles should be labeled now.

One possibility would be to remove the exception for /var/log/pacemaker/bundles, so that it gets cluster_var_log_t, and allow container_t to write to that. A similar approach is taken by OpenStack (see https://github.com/redhat-openstack/openstack-selinux/pull/31 ), so this would simply make that a general policy. However I could see an argument for being more restrictive.

Another possibility would be to label /var/log/pacemaker/bundles with some existing label that container_t is already allowed access to, or to create a new label for the purpose.