+1 from me
On Sun, Jul 2, 2017 at 8:54 PM, Kevin Fenzi <kevin@xxxxxxxxx> wrote:
> Greetings.
>
> Currently our mirrorlist containers on proxies aren't getting their logs rotated due to selinux policy. This patch hopefully fixes that and allows them to be rotated.
>
> I have tested this on proxy01.stg and it seems to work there now.
>
> +1s?
> --
> From 7b0ebec7dbc1085977a727298648516c7198555e Mon Sep 17 00:00:00 2001
> From: Kevin Fenzi <kevin@xxxxxxxxx>
> Date: Sun, 2 Jul 2017 18:45:49 +0000
> Subject: [PATCH] initial selinux policy to allow logrotate to rotate
> mirrorlist container log files
>
> Signed-off-by: Kevin Fenzi <kevin@xxxxxxxxx>
> ---
> .../files/selinux/mirrorlist-logrotate.mod | Bin 0 -> 1204 bytes
> .../files/selinux/mirrorlist-logrotate.pp | Bin 0 -> 1220 bytes
> .../files/selinux/mirrorlist-logrotate.te | 12 ++++++++++++
> .../mirrormanager/mirrorlist_proxy/tasks/main.yml | 21 +++++++++++++++++++++
> 4 files changed, 33 insertions(+)
> create mode 100644 roles/mirrormanager/mirrorlist_proxy/files/selinux/mirrorlist-logrotate.mod
> create mode 100644 roles/mirrormanager/mirrorlist_proxy/files/selinux/mirrorlist-logrotate.pp
> create mode 100644 roles/mirrormanager/mirrorlist_proxy/files/selinux/mirrorlist-logrotate.te
>
> diff --git a/roles/mirrormanager/mirrorlist_proxy/files/selinux/mirrorlist-logrotate.mod b/roles/mirrormanager/mirrorlist_proxy/files/selinux/mirrorlist-logrotate.mod
> new file mode 100644
> index 0000000000000000000000000000000000000000..49ca37b8d4e43431ea086fcd61a1d83687dd1a47
> GIT binary patch
> literal 1204
> zcmb`GOHRWu6h%Y%N(>MZ3+M(wumew+!H5M!X=6}OT1$>wI$#Sdm=U}aa;a6Q7|<(S
> zzxzIZ{>Xm&czr)BisIpReAmnutMPrP7p)&z=-jwxJTZa`<E)7>#J1_uWgDJiNLBLt
> z7QeZ=c4js~8%PO|mR~pV(88?p5}V{tO^}Oz7M8x8S2NG*Osnd;_YX`1=1{6uk4@{3
> z%%^r5z3q$6Wc$v?CYaKB+j5FXNOvp<lV?9oWpuswHEh!=$@8oXIfVMFcV72>ab@C4
> znWA!&g<}}dEt{CiuA0}AuqruXnUvdR)k{lLr!~-Spz^ZBb2xLL^7H_%AJ+qUa=KwM
> zZlLDM63^kxfy&bdxPDv@<RNQp!es$8R6jiqVuCXP|EjT)9&WIhT#p8yn0je{#J0sP
> z)x!-Ivn!po{Fmfx+@1YTjwbT=c!ct0`9=CYOjR7sZ^&M}QdnO9Z!bKrv63J71QJ$M
> AiU0rr
>
> literal 0
> HcmV?d00001
>
> diff --git a/roles/mirrormanager/mirrorlist_proxy/files/selinux/mirrorlist-logrotate.pp b/roles/mirrormanager/mirrorlist_proxy/files/selinux/mirrorlist-logrotate.pp
> new file mode 100644
> index 0000000000000000000000000000000000000000..f4be1215e3c3fb0c4c15381f8d1c4c5495c70e9b
> GIT binary patch
> literal 1220
> zcmb`GOHRWu6h%Y%N(=yr1+W1S?7$OdFk%5w+87j+Hj?9(4%h->y^P=;lS{2a#Q?5!
> z{qFnt`6K)F{rPRHC<=INd@=vX?A`U*O*5M>&u+VV-ujV+PK=Zt7{RG=+Jw-Bw&~+}
> z+dYIXR?%-;{OaP;nOO&IASFOre%*v!3$w~oXrezfK`!`dxA5hxntE1eT2<G{-!ToC
> zL#bNbH?7|@pV~?Awl6x9O`Z2mFs1jl<rt8V?pV-`AN?ej!6ol=*rZjG=UEwY2=!O*
> zyzcAb%E*;6Mdc<7$1tE@G$EFKHLJ(nvgC+mRBn@1FD*@-)<C;~%F7bZ;mm=`(*w9P
> zt_Jetbi-uaK+TmUp2L{~m8TDIX<QBDA#1F|WdSr)KRpg&f-?bstFe*<H&{%rM}tpH
> zy|h1Ko8p#AaD&DCm(E)LNpd#s&i*Gy6Zv~QLiw`%BK;nwDvstiWG`MREU*8k7oOKx
> H$v1oey`EQ}
>
> literal 0
> HcmV?d00001
>
> diff --git a/roles/mirrormanager/mirrorlist_proxy/files/selinux/mirrorlist-logrotate.te b/roles/mirrormanager/mirrorlist_proxy/files/selinux/mirrorlist-logrotate.te
> new file mode 100644
> index 0000000..1028deb
> --- /dev/null
> +++ b/roles/mirrormanager/mirrorlist_proxy/files/selinux/mirrorlist-logrotate.te
> @@ -0,0 +1,12 @@
> +module mirrorlist-logrotate 1.0;
> +
> +require {
> + type logrotate_t;
> + type svirt_sandbox_file_t;
> + class file { setattr create write };
> + class dir { write add_name remove_name };
> +}
> +
> +#============= logrotate_t ==============
> +allow logrotate_t svirt_sandbox_file_t:dir { add_name remove_name write };
> +allow logrotate_t svirt_sandbox_file_t:file { setattr create write };
> diff --git a/roles/mirrormanager/mirrorlist_proxy/tasks/main.yml b/roles/mirrormanager/mirrorlist_proxy/tasks/main.yml
> index ebec129..37c45a0 100644
> --- a/roles/mirrormanager/mirrorlist_proxy/tasks/main.yml
> +++ b/roles/mirrormanager/mirrorlist_proxy/tasks/main.yml
> @@ -97,3 +97,24 @@
> cron_file=restart-mirrorlist-containers
> tags:
> - mirrorlist_proxy
> +
> +# Custom selinux policy to allow logrotate to rotate our mirrorlist logs
> +- name: ensure a directory exists for our custom selinux module
> + file: dest=/usr/local/share/mirrorlist-logrotate state=directory
> + tags:
> + - selinux
> + - mirrorlist_proxy
> +
> +- name: copy over our custom selinux module
> + copy: src=selinux/mirrorlist-logrotate.pp dest=/usr/local/share/mirrorlist-logrotate/mirrorlist-logrotate.pp
> + register: selinux_module
> + tags:
> + - selinux
> + - mirrorlist_proxy
> +
> +- name: install our custom selinux module
> + command: semodule -i /usr/local/share/mirrorlist-logrotate/mirrorlist-logrotate.pp
> + when: selinux_module|changed
> + tags:
> + - selinux
> + - mirrorlist_proxy
> --
> 1.8.3.1
>
>
> _______________________________________________
> infrastructure mailing list -- infrastructure@xxxxxxxxxxxxxxxxxxxxxxx
> To unsubscribe send an email to infrastructure-leave@xxxxxxxxxxxxxxxxxxxxxxx
>
_______________________________________________
infrastructure mailing list -- infrastructure@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to infrastructure-leave@xxxxxxxxxxxxxxxxxxxxxxx
