Bug 1730782 - AVC denials from logrotate on multiple containers
Summary: AVC denials from logrotate on multiple containers
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: openstack-tripleo-heat-templates
Version: 13.0 (Queens)
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: zstream
: 13.0 (Queens)
Assignee: Cédric Jeanneret
QA Contact: Sasha Smolyak
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-07-17 15:21 UTC by Julie Pichon
Modified: 2019-09-03 16:56 UTC (History)
3 users (show)

Fixed In Version: openstack-tripleo-heat-templates-8.3.1-57.el7ost
Doc Type: No Doc Update
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-09-03 16:55:57 UTC
Target Upstream Version:


Attachments (Terms of Use)
Audit log (2.86 MB, text/plain)
2019-07-17 15:23 UTC, Julie Pichon
no flags Details


Links
System ID Private Priority Status Summary Last Updated
Launchpad 1836000 0 None None None 2019-07-17 15:21:51 UTC
OpenStack gerrit 671313 0 None MERGED Allow logrotate to access container_file_t files 2021-01-28 20:45:10 UTC
Red Hat Product Errata RHBA-2019:2624 0 None None None 2019-09-03 16:56:17 UTC

Description Julie Pichon 2019-07-17 15:21:52 UTC
Description of problem:

There is a number of AVC denials related to logrotate and containers when running on RHEL 7.7 (cf bug 1730723 comment 1).

type=AVC msg=audit(1563305281.736:9590): avc:  denied  { read } for  pid=269489 comm="logrotate" name="gnocchi" dev="vda2" ino=13572601 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1563305281.738:9591): avc:  denied  { read } for  pid=269489 comm="logrotate" name="aodh" dev="vda2" ino=6028974 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1563305281.739:9592): avc:  denied  { read } for  pid=269489 comm="logrotate" name="ceilometer" dev="vda2" ino=9636557 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1563305281.739:9593): avc:  denied  { read } for  pid=269489 comm="logrotate" name="cinder" dev="vda2" ino=1841627 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1563305281.739:9594): avc:  denied  { read } for  pid=269489 comm="logrotate" name="horizon" dev="vda2" ino=13572607 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1563305281.739:9595): avc:  denied  { read } for  pid=269489 comm="logrotate" name="glance" dev="vda2" ino=6028967 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1563305281.740:9596): avc:  denied  { read } for  pid=269489 comm="logrotate" name="heat" dev="vda2" ino=6028970 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1563305281.741:9597): avc:  denied  { read } for  pid=269489 comm="logrotate" name="keystone" dev="vda2" ino=9636564 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1563305281.741:9598): avc:  denied  { read } for  pid=269489 comm="logrotate" name="neutron" dev="vda2" ino=1841630 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1563305281.742:9599): avc:  denied  { read } for  pid=269489 comm="logrotate" name="nova" dev="vda2" ino=1841634 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1563305281.742:9600): avc:  denied  { read } for  pid=269489 comm="logrotate" name="panko" dev="vda2" ino=13588064 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1563305281.742:9601): avc:  denied  { read } for  pid=269489 comm="logrotate" name="sahara" dev="vda2" ino=1841633 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1563305281.744:9602): avc:  denied  { read } for  pid=269489 comm="logrotate" name="rabbitmq" dev="vda2" ino=6028969 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1563305281.745:9603): avc:  denied  { read } for  pid=269489 comm="logrotate" name="redis" dev="vda2" ino=1841632 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0


Additional info:

This can be fixed by enabling the logrotate_read_inside_containers, which appears to be resolved upstream for later releases https://bugs.launchpad.net/tripleo/+bug/1836000

Comment 1 Julie Pichon 2019-07-17 15:23:09 UTC
Created attachment 1591461 [details]
Audit log

Comment 9 Sasha Smolyak 2019-08-26 08:20:17 UTC
No more denials in audit log. Verified

Comment 11 errata-xmlrpc 2019-09-03 16:55:57 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:2624


Note You need to log in before you can comment on or make changes to this bug.