logrotate and /var/log/rpmpkgs ....

Paul Howarth paul at city-fan.org
Tue Oct 2 09:41:33 UTC 2007

Daniel J Walsh wrote:
> Tom London wrote:
>> Running latest Rawhide, targeted/enforcing.
>> When cron runs logrotate, I get AVC on access to /var/log/rpmpkgs:
>> type=AVC msg=audit(1191172944.569:41): avc:  denied  { getattr } for
>> pid=6581 comm="logrotate" path="/var/log/rpmpkgs" dev=dm-0 ino=99163
>> scontext=system_u:system_r:logrotate_t:s0
>> tcontext=system_u:object_r:root_t:s0 tclass=file
>> type=SYSCALL msg=audit(1191172944.569:41): arch=40000003 syscall=195
>> success=no exit=-13 a0=8931228 a1=bfa7b320 a2=5b67ff4 a3=0 items=0
>> ppid=6579 pid=6581 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
>> egid=0 sgid=0 fsgid=0 tty=(none) comm="logrotate"
>> exe="/usr/sbin/logrotate" subj=system_u:system_r:logrotate_t:s0
>> key=(null)
>> Should there be a directory in /var/log for these logs (with the
>> appropriate label)?
>> tom
> How is a file in /var/log being labeled rpmpkgs.  Looks like this file
> is created in / and then mv'd to /var/log?

Don't think so; it should be created by /etc/cron.daily/rpm, which on F7 is:

/bin/rpm -qa --qf '%{name}-%{version}-%{release}.%{arch}.rpm\n' 2>&1 \
         | /bin/sort > /var/log/rpmpkgs


More information about the fedora-selinux-list mailing list