Bug 427274 - logrotate fails to preserve SELinux file contexts
logrotate fails to preserve SELinux file contexts
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: logrotate (Show other bugs)
8
All Linux
low Severity low
: ---
: ---
Assigned To: Tomas Smetana
Fedora Extras Quality Assurance
:
: 427150 428500 (view as bug list)
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2008-01-02 13:16 EST by Paul Howarth
Modified: 2008-01-15 17:52 EST (History)
4 users (show)

See Also:
Fixed In Version: 3.7.6-2.1.fc8
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-01-15 17:52:23 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Paul Howarth 2008-01-02 13:16:30 EST
Description of problem:
The empty log files created after a logrotate run have (at least in /var/log)
the default context var_log_t rather than any specific file context that might
be required, e.g. faillog_t for /var/log/btmp, rpm_log_t for /var/log/rpmpkgs.

Version-Release number of selected component (if applicable):
logrotate-3.7.6-1.3.fc8

How reproducible:
Easy

Steps to Reproduce:
1. Install Fedora 8 with a default config
2. Wait for logrotate to do its stuff
3. See the SELinux denials that result, e.g.

type=AVC msg=audit(1199231495.982:35629): avc:  denied  { append } for 
pid=30802 comm="sshd" name="btmp" dev=dm-3 ino=1212485
scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023
tcontext=system_u:object_r:var_log_t:s0 tclass=file
Comment 1 Ben Webb 2008-01-02 19:09:15 EST
Same problem on my systems (also F8, i386 and x86_64). Looks also like bug
#427150 is the same issue.
Comment 2 Tomas Smetana 2008-01-03 03:33:45 EST
I have examined the files on my desktop and they happen to have also wrong
contexts.  I see no AVC messages though...  Thanks for reporting.
Comment 3 Paul Howarth 2008-01-03 03:48:53 EST
(In reply to comment #2)
> I have examined the files on my desktop and they happen to have also wrong
> contexts.  I see no AVC messages though...  Thanks for reporting.

Your desktop probably doesn't have an Internet-accessible ssh daemon getting
pounded by script kiddies and generating login failures, hence no AVCs.
Comment 4 Daniel Walsh 2008-01-03 10:19:46 EST
*** Bug 427150 has been marked as a duplicate of this bug. ***
Comment 5 Fedora Update System 2008-01-11 17:04:01 EST
logrotate-3.7.6-2.1.fc8 has been pushed to the Fedora 8 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update logrotate'
Comment 6 Tomas Smetana 2008-01-15 01:52:52 EST
*** Bug 428500 has been marked as a duplicate of this bug. ***
Comment 7 Fedora Update System 2008-01-15 17:52:19 EST
logrotate-3.7.6-2.1.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.