Description of problem: I see the https://github.com/RedHatInsights/insights-core/pull/3850 that is recently added, but actually it lacks the SELinux policy to allow it. + sudo ausearch -i -m avc,user_avc -ts today ~~~ node=abc-host type=PROCTITLE msg=audit(08/03/2023 13:52:01.275:156177) : proctitle=/usr/libexec/platform-python /usr/lib/python3.6/site-packages/insights_client/run.py --retry 3 node=abc-host type=PATH msg=audit(08/03/2023 13:52:01.275:156177) : item=1 name=/var/log/log_lock.pid inode=2241455 dev=fd:00 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:var_log_t:s0 nametype=CREATE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 node=abc-host type=PATH msg=audit(08/03/2023 13:52:01.275:156177) : item=0 name=/var/log/ inode=2097865 dev=fd:00 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:var_log_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 node=abc-host type=CWD msg=audit(08/03/2023 13:52:01.275:156177) : cwd=/ node=abc-host type=SYSCALL msg=audit(08/03/2023 13:52:01.275:156177) : arch=x86_64 syscall=openat success=yes exit=12 a0=AT_FDCWD a1=0x7f21c7781be8 a2=O_RDWR|O_CREAT|O_CLOEXEC a3=0x1a4 items=2 ppid=2966557 pid=2966623 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=platform-python exe=/usr/libexec/platform-python3.6 subj=system_u:system_r:insights_client_t:s0 key=(null) node=abc-host type=AVC msg=audit(08/03/2023 13:52:01.275:156177) : avc: denied { write } for pid=2966623 comm=platform-python path=/var/log/log_lock.pid dev="dm-0" ino=2241455 scontext=system_u:system_r:insights_client_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file permissive=1 node=abc-host type=AVC msg=audit(08/03/2023 13:52:01.275:156177) : avc: denied { create } for pid=2966623 comm=platform-python name=log_lock.pid scontext=system_u:system_r:insights_client_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file permissive=1 ---- node=abc-host type=PROCTITLE msg=audit(08/03/2023 13:52:01.275:156178) : proctitle=/usr/libexec/platform-python /usr/lib/python3.6/site-packages/insights_client/run.py --retry 3 node=abc-host type=PATH msg=audit(08/03/2023 13:52:01.275:156178) : item=0 name=/var/log/dnf.log inode=2242945 dev=fd:00 mode=file,600 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:var_log_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 node=abc-host type=CWD msg=audit(08/03/2023 13:52:01.275:156178) : cwd=/ node=abc-host type=SYSCALL msg=audit(08/03/2023 13:52:01.275:156178) : arch=x86_64 syscall=chmod success=yes exit=0 a0=0x7f21c7781be8 a1=0600 a2=0x0 a3=0x2 items=1 ppid=2966557 pid=2966623 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=platform-python exe=/usr/libexec/platform-python3.6 subj=system_u:system_r:insights_client_t:s0 key=(null) node=abc-host type=AVC msg=audit(08/03/2023 13:52:01.275:156178) : avc: denied { setattr } for pid=2966623 comm=platform-python name=dnf.log dev="dm-0" ino=2242945 scontext=system_u:system_r:insights_client_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file permissive=1 ---- node=abc-host type=PROCTITLE msg=audit(08/03/2023 13:52:01.275:156179) : proctitle=/usr/libexec/platform-python /usr/lib/python3.6/site-packages/insights_client/run.py --retry 3 node=abc-host type=PATH msg=audit(08/03/2023 13:52:01.275:156179) : item=1 name=/var/log/log_lock.pid inode=2241455 dev=fd:00 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:var_log_t:s0 nametype=DELETE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 node=abc-host type=PATH msg=audit(08/03/2023 13:52:01.275:156179) : item=0 name=/var/log/ inode=2097865 dev=fd:00 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:var_log_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 node=abc-host type=CWD msg=audit(08/03/2023 13:52:01.275:156179) : cwd=/ node=abc-host type=SYSCALL msg=audit(08/03/2023 13:52:01.275:156179) : arch=x86_64 syscall=unlink success=yes exit=0 a0=0x7f21c7781be8 a1=0x0 a2=0x0 a3=0x1 items=2 ppid=2966557 pid=2966623 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=platform-python exe=/usr/libexec/platform-python3.6 subj=system_u:system_r:insights_client_t:s0 key=(null) node=abc-host type=AVC msg=audit(08/03/2023 13:52:01.275:156179) : avc: denied { unlink } for pid=2966623 comm=platform-python name=log_lock.pid dev="dm-0" ino=2241455 scontext=system_u:system_r:insights_client_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file permissive=1 ... + sudo audit2allow -a #============= insights_client_t ============== allow insights_client_t var_log_t:file { create setattr unlink write }; ~~~ Version-Release number of selected component (if applicable): RHEL 8.8 selinux-policy-devel-3.14.3-124.el8.noarch selinux-policy-3.14.3-124.el8.noarch selinux-policy-targeted-3.14.3-124.el8.noarch How reproducible: Always Steps to Reproduce: 1. Register RHEL 8.8 host with Insights 2. Install latest(pre-released) selinux-policy packages 3. Restart `insights-client` service Actual results: SELinux AVC denials for insights-client var-log-t Expected results: Insights upload should complete without any AVC triggered.
Commit to backport: 97f7155ab Allow insights-client create all rpm logs with a correct label 8f443b560 Allow insights-client manage generic logs