logrotate and /var/log/rpmpkgs ....

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Paul Howarth wrote:
> Daniel J Walsh wrote:
>> Tom London wrote:
>>> Running latest Rawhide, targeted/enforcing.
>>>
>>> When cron runs logrotate, I get AVC on access to /var/log/rpmpkgs:
>>>
>>> type=AVC msg=audit(1191172944.569:41): avc:  denied  { getattr } for
>>> pid=6581 comm="logrotate" path="/var/log/rpmpkgs" dev=dm-0 ino=99163
>>> scontext=system_u:system_r:logrotate_t:s0
>>> tcontext=system_u:object_r:root_t:s0 tclass=file
>>> type=SYSCALL msg=audit(1191172944.569:41): arch=40000003 syscall=195
>>> success=no exit=-13 a0=8931228 a1=bfa7b320 a2=5b67ff4 a3=0 items=0
>>> ppid=6579 pid=6581 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
>>> egid=0 sgid=0 fsgid=0 tty=(none) comm="logrotate"
>>> exe="/usr/sbin/logrotate" subj=system_u:system_r:logrotate_t:s0
>>> key=(null)
>>>
>>> Should there be a directory in /var/log for these logs (with the
>>> appropriate label)?
>>>
>>> tom
>> How is a file in /var/log being labeled rpmpkgs.  Looks like this file
>> is created in / and then mv'd to /var/log?
> 
> Don't think so; it should be created by /etc/cron.daily/rpm, which on F7
> is:
> 
> /bin/rpm -qa --qf '%{name}-%{version}-%{release}.%{arch}.rpm\n' 2>&1 \
>         | /bin/sort > /var/log/rpmpkgs
> 
> Paul.
But not in F8

#!/bin/sh

tmpfile=`/bin/mktemp rpmpkgs.XXXXXXXXX` || exit 1
/bin/rpm -qa --qf '%{name}-%{version}-%{release}.%{arch}.rpm\n' 2>&1 \
        | /bin/sort > "$tmpfile"

[ -s "$tmpfile" ] || exit 1
/bin/mv "$tmpfile" /var/log/rpmpkgs
/bin/chmod 0644 /var/log/rpmpkgs


This should be.

#!/bin/sh

tmpfile=`/bin/mktemp /var/log/rpmpkgs.XXXXXXXXX` || exit 1
/bin/rpm -qa --qf '%{name}-%{version}-%{release}.%{arch}.rpm\n' 2>&1 \
        | /bin/sort > "$tmpfile"

[ -s "$tmpfile" ] || exit 1
/bin/mv "$tmpfile" /var/log/rpmpkgs
/bin/chmod 0644 /var/log/rpmpkgs

And the SELinux context would be right.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iD8DBQFHAjF4rlYvE4MpobMRAnpoAJ9ScKQeNy7KeZGL8cWRxyHv5lHQgwCgplSN
LoUbGhWKU3tbqlXFXP5zV3A=
=QoXo
-----END PGP SIGNATURE-----