This bug was initially created as a copy of Bug #1795681

I am copying this bug because: 

Also applies to RHEL 8


Description of problem:

Although logrotate can operate on NFS file systems thanks to logrotate_use_nfs boolean, a similar set of rules is missing for CIFS file systems.
Customers hitting this need to create the following custom policy:

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
gen_require(`
	type logrotate_t;
')

gen_tunable(logrotate_use_cifs, false)

tunable_policy(`logrotate_use_cifs',`
	fs_manage_cifs_files(logrotate_t)
	fs_manage_cifs_dirs(logrotate_t)
	fs_manage_cifs_symlinks(logrotate_t)
')
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

Please integrate this in the standard policy.


Version-Release number of selected component (if applicable):

selinux-policy-3.14.3-20.el8.noarch

How reproducible:

Always


Steps to Reproduce:
1. Set up a CIFS mount point

On a CIFS server:

# yum -y install samba

/etc/samba/smb.conf:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
[share]
	comment = CIFS SHARE
	path = /mnt
	writeable = yes
	browseable = yes
	public = yes
	create mask = 0644
	directory mask = 0755
	force user = root
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

# systemctl restart smb
# useradd smbuser
# smbpasswd -a smbuser
# systemctl stop firewalld

On the client system:

# yum -y install cifs-utils
# mkdir /my_cifs_mount
# mount -t cifs -o username=smbuser,password=smbuser,rw //192.168.122.201/share /my_cifs_mount


2. Create a logrotate file to copy logs after rotation to the CIFS mount point

e.g. /etc/logrotate.d/cifs:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
/var/log/cifs.log
{
    missingok
    daily
    copytruncate
    rotate 7

    postrotate
        cp /var/log/cifs.log-* /my_cifs_mount
    endscript
}
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

3. Populate the file

  # echo "FOO" >> /var/log/cifs.log

4. Execute logrotate

  # runcon -u system_u -r system_r -t logrotate_t logrotate -v -f /etc/logrotate.d/cifs

Actual results:

AVCs

time->Wed Jan 29 09:53:44 2020
type=PROCTITLE msg=audit(1580288024.306:165): proctitle=6370002F7661722F6C6F672F636966732E6C6F672E31002F7661722F6C6F672F636966732E6C6F672E32002F7661722F6C6F672F636966732E6C6F672E33002F7661722F6C6F672F636966732E6C6F672E34002F7661722F6C6F672F636966732E6C6F672E35002F6D795F636966735F6D6F756E74
type=PATH msg=audit(1580288024.306:165): item=0 name="/my_cifs_mount/cifs.log.1" inode=2772 dev=00:2e mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:cifs_t:s0 nametype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1580288024.306:165): cwd="/root"
type=SYSCALL msg=audit(1580288024.306:165): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=55b282e20ee0 a2=201 a3=0 items=1 ppid=18144 pid=18145 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=2 comm="cp" exe="/usr/bin/cp" subj=system_u:system_r:logrotate_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1580288024.306:165): avc:  denied  { write } for  pid=18145 comm="cp" name="cifs.log.1" dev="cifs" ino=2772 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:cifs_t:s0 tclass=file permissive=0
...