SELinux prevents tmpwatch to remove old logs

Bug #1922002 reported by Cédric Jeanneret on 2021-03-31
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
tripleo
Medium
Cédric Jeanneret

Bug Description

(First reported as rhbz#1944466)

Summary:
SELinux prevents tmpwatch to remove files, blocking a weird need for dac_override:

type=AVC msg=audit(1612722661.648:718821): avc: denied { dac_override } for pid=621991 comm="tmpwatch" capability=1 scontext=system_u:system_r:tmpreaper_t:s0-s0:c0.c1023 tcontext=system_u:system_r:tmpreaper_t:s0-s0:c0.c1023 tclass=capability permissive=0

This leads to the following logs:

error: failed to unlink /var/log/containers/heat: heat_api.log.2.gz
[and any other variant]

After extensive tests, it seems the way cron.daily content is launched doesn't meet all the requirement for the environment, leading to the above issue. Pushing the exact same job in root's crontab solves the issue.

This is hitting osp-16.1, so we'll need to backport it down to stable/train...

Revision history for this message
Cédric Jeanneret (cjeanner) wrote :

Fix for Master (and needing backports down to stable/train)
https://review.opendev.org/c/openstack/tripleo-heat-templates/+/784008

Changed in tripleo:
status: Triaged → In Progress
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/tripleo-heat-templates 12.4.3

This issue was fixed in the openstack/tripleo-heat-templates 12.4.3 release.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/tripleo-heat-templates 14.1.0

This issue was fixed in the openstack/tripleo-heat-templates 14.1.0 release.

Changed in tripleo:
milestone: wallaby-rc1 → xena-1
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/tripleo-heat-templates 13.3.0

This issue was fixed in the openstack/tripleo-heat-templates 13.3.0 release.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/tripleo-heat-templates 11.6.0

This issue was fixed in the openstack/tripleo-heat-templates 11.6.0 release.

Changed in tripleo:
milestone: xena-1 → xena-2
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers