Description of problem: There is a number of AVC denials related to logrotate and containers when running on RHEL 7.7 (cf bug 1730723 comment 1). type=AVC msg=audit(1563305281.736:9590): avc: denied { read } for pid=269489 comm="logrotate" name="gnocchi" dev="vda2" ino=13572601 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0 type=AVC msg=audit(1563305281.738:9591): avc: denied { read } for pid=269489 comm="logrotate" name="aodh" dev="vda2" ino=6028974 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0 type=AVC msg=audit(1563305281.739:9592): avc: denied { read } for pid=269489 comm="logrotate" name="ceilometer" dev="vda2" ino=9636557 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0 type=AVC msg=audit(1563305281.739:9593): avc: denied { read } for pid=269489 comm="logrotate" name="cinder" dev="vda2" ino=1841627 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0 type=AVC msg=audit(1563305281.739:9594): avc: denied { read } for pid=269489 comm="logrotate" name="horizon" dev="vda2" ino=13572607 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0 type=AVC msg=audit(1563305281.739:9595): avc: denied { read } for pid=269489 comm="logrotate" name="glance" dev="vda2" ino=6028967 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0 type=AVC msg=audit(1563305281.740:9596): avc: denied { read } for pid=269489 comm="logrotate" name="heat" dev="vda2" ino=6028970 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0 type=AVC msg=audit(1563305281.741:9597): avc: denied { read } for pid=269489 comm="logrotate" name="keystone" dev="vda2" ino=9636564 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0 type=AVC msg=audit(1563305281.741:9598): avc: denied { read } for pid=269489 comm="logrotate" name="neutron" dev="vda2" ino=1841630 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0 type=AVC msg=audit(1563305281.742:9599): avc: denied { read } for pid=269489 comm="logrotate" name="nova" dev="vda2" ino=1841634 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0 type=AVC msg=audit(1563305281.742:9600): avc: denied { read } for pid=269489 comm="logrotate" name="panko" dev="vda2" ino=13588064 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0 type=AVC msg=audit(1563305281.742:9601): avc: denied { read } for pid=269489 comm="logrotate" name="sahara" dev="vda2" ino=1841633 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0 type=AVC msg=audit(1563305281.744:9602): avc: denied { read } for pid=269489 comm="logrotate" name="rabbitmq" dev="vda2" ino=6028969 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0 type=AVC msg=audit(1563305281.745:9603): avc: denied { read } for pid=269489 comm="logrotate" name="redis" dev="vda2" ino=1841632 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:container_file_t:s0 tclass=dir permissive=0 Additional info: This can be fixed by enabling the logrotate_read_inside_containers, which appears to be resolved upstream for later releases https://bugs.launchpad.net/tripleo/+bug/1836000
Created attachment 1591461 [details] Audit log
No more denials in audit log. Verified
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2019:2624