Skip to content
This repository has been archived by the owner on Sep 12, 2024. It is now read-only.

selinux prevents logroate on omsconfig logs #812

Open
Klaas- opened this issue Aug 18, 2021 · 0 comments
Open

selinux prevents logroate on omsconfig logs #812

Klaas- opened this issue Aug 18, 2021 · 0 comments

Comments

@Klaas-
Copy link

Klaas- commented Aug 18, 2021

This is a follow up from microsoft/omi#680 and microsoft/OMS-Agent-for-Linux#781

I was told the dir /var/opt/microsoft/omsconfig belongs to this product group. Selinux is preventing the logrotation of two logfiles:

$ ls -al /var/opt/microsoft/omsconfig/*log
-rw-r--r--. 1 omsagent omiusers 39822330 Aug 18 11:09 /var/opt/microsoft/omsconfig/omsconfigdetailed.log
-rw-r--r--. 1 omsagent omiusers  2857121 Aug 18 11:09 /var/opt/microsoft/omsconfig/omsconfig.log

https://github.com/microsoft/OMS-Agent-for-Linux/blob/638a242a595fe1a096105d763062d350d26b9b75/installer/selinux/omsagent-logrotate.fc
that is the current selinux configuration that only includes the files.

https://github.com/microsoft/PowerShell-DSC-for-Linux/blob/9f6301f16bb3ce665e886fb728b63d1ad3f78cae/Providers/Extras/Scripts/omsconfig_logrotate.conf
is the logrotate config that wants to rotate the logs

now these two combined are not enough to logrotate because selinux is blocking logrotate from the directory /var/opt/microsoft/omsconfig/

Error messages look like this:

error: error accessing /var/opt/microsoft/omsconfig: Permission denied
error: failed to rename /var/opt/microsoft/omsconfig/omsconfig.log to /var/opt/microsoft/omsconfig/omsconfig.log-20210812: Permission denied
error: error accessing /var/opt/microsoft/omsconfig: Permission denied
error: failed to rename /var/opt/microsoft/omsconfig/omsconfigdetailed.log to /var/opt/microsoft/omsconfig/omsconfigdetailed.log-20210812: Permission denied

Possible solutions:

  1. you can change the selinux context of that that dir to var_log_t and it should work, but that means logrotate gets additional rights on the non-log subdirs
  2. you can change the log directory to /var/opt/microsoft/omsconfig/log for log files and give it var_log_t (right solution I would say)
  3. you can disable the logs (possible short term workaround)

This is all covered in several issues on github:
microsoft/OMS-Agent-for-Linux#781 (from september 2018, that’s how long this has been an issue)
microsoft/omi#680 (additional problem related to selinux, needs at least two versions released for complete fix if you want to keep using the omi selinux rules because of the post-script nature)

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant