What should be the security context of these cron files?

Question

I am running Fedora 20 and I am having some issues when running logrotate and anacron which I suspect may be related to SELinux:

Failed to determine timestamp: Cannot assign requested address
chgrp: changing group of /var/log/mariadb: Permission denied

I did some research and came across this article from Gentoo wiki that says the following:

If you want to perform system administrative tasks using cronjobs, you will need to take special care that the domain in which the job runs has sufficient privileges.

First, make sure that your cronjobs run in the system_cronjob_t domains. This means that the cronjobs must be defined as either

scripts in the /etc/cron.hourly, /etc/cron.daily, ... directories
crontab entries in the /etc/cron.d directory
crontab entries in the /etc/crontab file

A check on my SELinux default policies reveals that I have the following instead:

/etc/cron.daily(/.*)?    all files      system_u:object_r:bin_t:s0 
/etc/cron.hourly(/.*)?   all files      system_u:object_r:bin_t:s0 
/etc/cron.monthly(/.*)?  all files      system_u:object_r:bin_t:s0 
/etc/cron.weekly(/.*)?   all files      system_u:object_r:bin_t:s0 
/etc/cron\.d(/.*)?       all files      system_u:object_r:system_cron_spool_t:s0 
/etc/crontab             regular file   system_u:object_r:system_cron_spool_t:s0

Should I change the SELinux policy to so that these have system_cronjob_t as the context label instead?

Answer 1

It seems that this is how it should be:

From changelog of selinux-policy-3.12.1-139:

- Allow systemd_cronjob_t to be entered via bin_t

Do you have any errors in /var/log/audit/audit.log pertaining to mariadb? A quick and easy check is to setenforce=0 and run your cron jobs. If they fare better then it was SELinux causing the issue.