Red Hat Bugzilla – Bug 977415
AVC denials when using openvswitch logrotate
Last modified: 2013-11-21 05:31:42 EST
Created attachment 764629 [details] Logs from bug 976000 Description of problem: I just encountered new AVC on one of my compute nodes openstack-selinux-0.1.2-10.el6ost.noarch selinux-policy-3.7.19-195.el6_4.11.noarch selinux-policy-targeted-3.7.19-195.el6_4.11.noarch Jun 23 03:14:01 puma40 kernel: type=1400 audit(1371946441.174:4): avc: denied { write } for pid=20391 comm="ovs-appctl" name="ovs-vswitchd.pid" dev=dm-0 ino=3801130 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=file Jun 23 03:14:01 puma40 ovs-appctl: 00001|daemon|WARN|/var/run/openvswitch/ovs-vswitchd.pid: open: Permission denied Jun 23 03:14:01 puma40 ovs-appctl: 00001|daemon|WARN|/var/run/openvswitch/ovsdb-server.pid: open: Permission denied Jun 23 03:14:01 puma40 kernel: type=1400 audit(1371946441.176:5): avc: denied { write } for pid=20392 comm="ovs-appctl" name="ovsdb-server.pid" dev=dm-0 ino=3801127 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=file Looks like logrotate daemon rotated logs and tried to update PID in /var/run/openvswitch/ovs-vswitchd.pid which was denied. Usually the logrotate script sends a SIGHUP to a deamon to order him to reopen log files after they were rotated. But that probably won't change the PID and also the scontext would be different. The other option is that the service was restarted (insted of sending HUP) but that is not very common for __bigger__ daemons I think. Check the logrotate script (/etc/logrotate.d/...) to see what actually happens once the logs reach the size limit. Version-Release number of selected component (if applicable): How reproducible: Steps to Reproduce: 1. run openstack setup for few days ( or operate openvswitch log rotate) 2. check AVC on /var/log/messages compute nodes 3. Actual results: Expected results: Additional info:
Fixed in selinux-policy-3.7.19-206.el6
Hi I have tried to reproduce with Milos help edit crontab -e with * * * * * logrotate -f /etc/logrotate.d/openvswitch * * * * * logrotate -f /etc/logrotate.d/openstack-quantum Didn't see any AVC Ofer
Issue is reproduced thanks to Milos Steps: ## modify following lines in /etc/anacrontab RANDOM_DELAY=1 1 1 cron.daily nice run-parts /etc/cron.daily service auditd stop rm -f /var/log/audit/audit.log service auditd start rm -f /var/log/openvswitch/* service openvswitch restart rm -f /var/spool/anacron/cron.daily killall anacron ## modify following lines in /var/lib/logrotate.status /var/log/openvswitch/ovsdb-server.log" 2013-6-06 /var/log/openvswitch/ovs-vswitchd.log" 2013-6-06 date 06260300 tail -f /var/log/cron (wait 2 minutes) ausearch -m avc -m selinux_err -i
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2013-1598.html