0

I am trying to get logrotate to work and keep getting the follow error message.

/etc/cron.daily/logrotate:
error: error accessing /ftp/logs: Permission denied
error: error opening /ftp/logs/sftp_system.log: Permission denied

Below are the folder rights:

drwxrwx---. 2 psoft psoft          4096 Jun 19 09:05 logs

Below are the file rights:

-rw-rw-r--. 1 psoft psoft  43449642 Jun 19 09:15 sftp_system.log

Here is the config:

/ftp/logs/sftp_system.log
{
        su psoft psoft
        size=25M
        rotate 5
        copytruncate
        create 0664 psoft psoft
        notifempty
}

I assume logrotate runs as root. I have tried changing file and folder rights and ownership and always get the same message. My OS is Oracle Linux 7 which is basically Redhat 7.

root@DB-PRD1 etc]# ausearch -ts today -m avc -i
----
type=PROCTITLE msg=audit(06/19/2019 03:09:01.964:15543) : proctitle=/usr/sbin/logrotate -s /var/lib/logrotate/logrotate.status /etc/logrotate.conf
type=SYSCALL msg=audit(06/19/2019 03:09:01.964:15543) : arch=x86_64 syscall=openat success=no exit=EACCES(Permission denied) a0=0xffffffffffffff9c a1=0x7fff6328bd90 a2=O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC a3=0x0 items=0 ppid=25062 pid=25065 auid=root uid=root gid=root euid=psoft suid=root fsuid=psoft egid=psoft sgid=root fsgid=psoft tty=(none) ses=1688 comm=logrotate exe=/usr/sbin/logrotate subj=system_u:system_r:logrotate_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(06/19/2019 03:09:01.964:15543) : avc:  denied  { read } for  pid=25065 comm=logrotate name=logs dev="dm-3" ino=2097153 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir permissive=0
----
type=PROCTITLE msg=audit(06/19/2019 03:09:01.965:15544) : proctitle=/usr/sbin/logrotate -s /var/lib/logrotate/logrotate.status /etc/logrotate.conf
type=SYSCALL msg=audit(06/19/2019 03:09:01.965:15544) : arch=x86_64 syscall=open success=no exit=EACCES(Permission denied) a0=0x2574570 a1=O_RDWR|O_NOFOLLOW a2=0x2574570 a3=0x3630393130322d67 items=0 ppid=25062 pid=25065 auid=root uid=root gid=root euid=psoft suid=root fsuid=psoft egid=psoft sgid=root fsgid=psoft tty=(none) ses=1688 comm=logrotate exe=/usr/sbin/logrotate subj=system_u:system_r:logrotate_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(06/19/2019 03:09:01.965:15544) : avc:  denied  { read write } for  pid=25065 comm=logrotate name=sftp_system.log dev="dm-3" ino=2097163 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file permissive=0


[root@DB-PRD1 etc]# sestatus
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Max kernel policy version:      29

=================

I received this email this morning

/etc/cron.daily/logrotate:

error: error accessing /ftp/logs: Permission denied error: error creating output file /ftp/logs/sftp_system.log-20190724: Permission denied

=================

[root@DB-PRD1 ftp]# ausearch -ts today -m avc -i

type=PROCTITLE msg=audit(07/24/2019 03:06:01.809:69341) : proctitle=/usr/sbin/logrotate -s /var/lib/logrotate/logrotate.status /etc/logrotate.conf type=SYSCALL msg=audit(07/24/2019 03:06:01.809:69341) : arch=x86_64 syscall=openat success=no exit=EACCES(Permission denied) a0=0xffffffffffffff9c a1=0x7ffe0b8767d0 a2=O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC a3=0x0 items=0 ppid=21723 pid=21725 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=7731 comm=logrotate exe=/usr/sbin/logrotate subj=system_u:system_r:logrotate_t:s0-s0:c0.c1023 key=(null)

type=AVC msg=audit(07/24/2019 03:06:01.809:69341) : avc: denied { read } for pid=21725 comm=logrotate name=logs dev="dm-3" ino=2097153 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir permissive=0

type=PROCTITLE msg=audit(07/24/2019 03:06:01.809:69342) : proctitle=/usr/sbin/logrotate -s /var/lib/logrotate/logrotate.status /etc/logrotate.conf type=SYSCALL msg=audit(07/24/2019 03:06:01.809:69342) : arch=x86_64 syscall=open success=no exit=EACCES(Permission denied) a0=0x1ccb3a0 a1=O_WRONLY|O_CREAT|O_EXCL|O_NOFOLLOW a2=0600 a3=0xe items=0 ppid=21723 pid=21725 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=7731 comm=logrotate exe=/usr/sbin/logrotate subj=system_u:system_r:logrotate_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(07/24/2019 03:06:01.809:69342) : avc: denied { write } for pid=21725 comm=logrotate name=logs dev="dm-3" ino=2097153 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir permissive=0

================

Does the directory containing the file need to have var_log_t access as well for this to work? I am going to try that and see if that makes a difference.

[root@DB-PRD1 ftp]# ls -dZ logs drwxrwx---. psoft psoft system_u:object_r:unlabeled_t:s0 logs

[root@DB-PRD1 logs]# ls -Z -rw-rw-r--. psoft psoft system_u:object_r:var_log_t:s0 sftp_system.log

  • Could you please add the output of sestatus? If SELinux is enabled, could you please check for logrotate-related errors in the audit log? You can query the audit log like so: ausearch -ts today -m avc -i. – Edward Jun 19 at 14:30
  • I edited my original question with the info you requested. – jack nbox Jun 19 at 15:05
0

SELinux has prevented the logrotate process, running in context logrotate_t, access to the sftp_system.log file.

The solution is to give the logrotate process access to the file by changing the file's context, like so:

semanage fcontext -a -t var_log_t /ftp/logs/sftp_system.log
restorecon -v /ftp/logs/sftp_system.log

Alternatively, you could move the SFTP log file out of the /ftp/ root into /var/log to get the right context automatically.

  • [root@DB-PRD1 logs]# ls -Z -rw-rw-r--. psoft psoft system_u:object_r:var_log_t:s0 sftp_system.log – jack nbox Jul 24 at 12:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.