I am running Fedora 20 and I am having some issues when running logrotate and anacron which I suspect may be related to SELinux:

Failed to determine timestamp: Cannot assign requested address
chgrp: changing group of /var/log/mariadb: Permission denied

I did some research and came across this article from Gentoo wiki that says the following:

If you want to perform system administrative tasks using cronjobs, you will need to take special care that the domain in which the job runs has sufficient privileges.

First, make sure that your cronjobs run in the system_cronjob_t domains. This means that the cronjobs must be defined as either

scripts in the /etc/cron.hourly, /etc/cron.daily, ... directories
crontab entries in the /etc/cron.d directory
crontab entries in the /etc/crontab file

A check on my SELinux default policies reveals that I have the following instead:

/etc/cron.daily(/.*)?    all files      system_u:object_r:bin_t:s0 
/etc/cron.hourly(/.*)?   all files      system_u:object_r:bin_t:s0 
/etc/cron.monthly(/.*)?  all files      system_u:object_r:bin_t:s0 
/etc/cron.weekly(/.*)?   all files      system_u:object_r:bin_t:s0 
/etc/cron\.d(/.*)?       all files      system_u:object_r:system_cron_spool_t:s0 
/etc/crontab             regular file   system_u:object_r:system_cron_spool_t:s0

Should I change the SELinux policy to so that these have system_cronjob_t as the context label instead?


It seems that this is how it should be:

From changelog of selinux-policy-3.12.1-139:

- Allow systemd_cronjob_t to be entered via bin_t

Do you have any errors in /var/log/audit/audit.log pertaining to mariadb? A quick and easy check is to setenforce=0 and run your cron jobs. If they fare better then it was SELinux causing the issue.

| improve this answer | |
  • Thank you. I do have SELinux error pertaining to logrotate trying to set permission on mariadb log files in one script. After perusing the permissions again, I find that I have context label etc_t for my crontab file, which could be the cause of all these problems. Will review it next week when that particular cron job is activated again. – Question Overflow Aug 11 '14 at 5:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.