Bug 742642 - logrotate can now switch user
Summary: logrotate can now switch user
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted
Version: 16
Hardware: x86_64
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Ben Levenson
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-09-30 21:21 UTC by Göran Uddeborg
Modified: 2011-10-09 19:35 UTC (History)
1 user (show)

Fixed In Version: selinux-policy-3.10.0-38.fc16
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-10-09 19:35:38 UTC
Type: ---


Attachments (Terms of Use)
Logrotate avc:s appearing without dontaudit rules. (1.25 KB, application/octet-stream)
2011-09-30 21:21 UTC, Göran Uddeborg
no flags Details
I'm currently using this little module as a workaround. (204 bytes, text/plain)
2011-09-30 21:23 UTC, Göran Uddeborg
no flags Details

Description Göran Uddeborg 2011-09-30 21:21:49 UTC
Created attachment 525839 [details]
Logrotate avc:s appearing without dontaudit rules.

Description of problem:
After a couple of updates, I started getting mails with this content

  /etc/cron.daily/logrotate:

  error: error switching euid to 25 and egid to 25: Operation not permitted

From what I can tell, this is because logrotate now has a configuration option to do the rotation under an alternate user id (option "su").  Bind is a package that uses this option.

Version-Release number of selected component (if applicable):
selinux-policy-targeted-3.10.0-28.fc16.noarch
logrotate-3.8.0-3.fc16.x86_64
bind-9.8.1-2.fc16.x86_64

How reproducible:
Every night

Steps to Reproduce:
1. Just install the above packages, and wait for logrotate to run
  
Actual results:
Error mail

Expected results:
No mail

Additional info:
I saw no AVC:s at first, but after disabling dontaudit rules there appeared two AVC:s that explained the issue.

Caveat in case it matters:
Since this machine has an nvidia card, and the "nvidia" X drivers are not available yet for F16 kernels from Rpmfusion, I'm still using a F15 kernel.  2.6.40.3-0.fc15.x86_64 to be precise.

Comment 1 Göran Uddeborg 2011-09-30 21:23:28 UTC
Created attachment 525840 [details]
I'm currently using this little module as a workaround.

Comment 2 Miroslav Grepl 2011-10-03 07:09:59 UTC
Yes, we don't audit this in the policy

# for mailx
dontaudit logrotate_t self:capability { setuid setgid sys_ptrace };

Looks like we will need to allow it if logrotate is supposed to do it.

Comment 3 Daniel Walsh 2011-10-03 14:50:34 UTC
Yes I agree allow setuid and setgid.

Comment 4 Miroslav Grepl 2011-10-03 19:04:28 UTC
Fixed in selinux-policy-3.10.0-36.fc16

Comment 5 Fedora Update System 2011-10-04 11:16:30 UTC
selinux-policy-3.10.0-36.fc16 has been submitted as an update for Fedora 16.
https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-36.fc16

Comment 6 Fedora Update System 2011-10-04 20:49:08 UTC
Package selinux-policy-3.10.0-36.fc16:
* should fix your issue,
* was pushed to the Fedora 16 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.10.0-36.fc16'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-36.fc16
then log in and leave karma (feedback).

Comment 7 Fedora Update System 2011-10-09 19:35:38 UTC
selinux-policy-3.10.0-38.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.