SELinux is preventing logrotate from read access on the directory /var/cache/dnf.

[Daniel J Walsh]

restorecon -R -v /var/cache

Should fix the problem.  There is a new release of selinux-policy that
hopefully will fix this label permanently.


On 12/21/2014 08:59 AM, Lawrence E Graves wrote:
> SELinux is preventing logrotate from read access on the directory
> /var/cache/dnf.
>
> ***** Plugin restorecon (94.8 confidence) suggests
> ************************
>
> If you want to fix the label.
> /var/cache/dnf default label should be rpm_var_cache_t.
> Then you can run restorecon.
> Do
> # /sbin/restorecon -v /var/cache/dnf
>
> ***** Plugin catchall_labels (5.21 confidence) suggests
> *******************
>
> If you want to allow logrotate to have read access on the dnf directory
> Then you need to change the label on /var/cache/dnf
> Do
> # semanage fcontext -a -t FILE_TYPE '/var/cache/dnf'
> where FILE_TYPE is one of the following: NetworkManager_log_t,
> NetworkManager_unit_file_t, NetworkManager_var_run_t,
> abrt_unit_file_t, abrt_var_cache_t, abrt_var_log_t, abrt_var_run_t,
> accountsd_unit_file_t, acct_data_t, admin_home_t, afs_logfile_t,
> aiccu_var_run_t, aide_log_t, ajaxterm_var_run_t, alsa_unit_file_t,
> alsa_var_run_t, amanda_log_t, amanda_unit_file_t, antivirus_log_t,
> antivirus_unit_file_t, antivirus_var_run_t, apcupsd_log_t,
> apcupsd_unit_file_t, apcupsd_var_run_t, apmd_log_t, apmd_unit_file_t,
> apmd_var_run_t, arpwatch_unit_file_t, arpwatch_var_run_t,
> asterisk_log_t, asterisk_var_run_t, audisp_var_run_t,
> auditd_unit_file_t, auditd_var_run_t, auth_cache_t,
> automount_unit_file_t, automount_var_run_t, avahi_unit_file_t,
> avahi_var_run_t, bacula_log_t, bacula_var_run_t, bcfg2_unit_file_t,
> bcfg2_var_run_t, bin_t, bitlbee_log_t, bitlbee_var_run_t,
> blktap_var_run_t, blueman_var_run_t, bluetooth_unit_file_t,
> bluetooth_var_run_t, boinc_log_t, boinc_unit_file_t, boot_t,
> bootloader_var_run_t, brltty_unit_file_t, brltty_var_run_t,
> bumblebee_unit_file_t, bumblebee_var_run_t, cachefilesd_var_run_t,
> calamaris_log_t, callweaver_log_t, callweaver_var_run_t, canna_log_t,
> canna_var_run_t, cardmgr_var_run_t, ccs_var_lib_t, ccs_var_log_t,
> ccs_var_run_t, cert_t, certmaster_var_log_t, certmaster_var_run_t,
> certmonger_var_run_t, cfengine_log_t, cgred_log_t, cgred_var_run_t,
> cgroup_t, checkpc_log_t, chronyd_unit_file_t, chronyd_var_log_t,
> chronyd_var_run_t, cinder_api_unit_file_t, cinder_backup_unit_file_t,
> cinder_log_t, cinder_scheduler_unit_file_t, cinder_var_run_t,
> cinder_volume_unit_file_t, clogd_var_run_t, cloud_init_unit_file_t,
> cloud_log_t, cluster_unit_file_t, cluster_var_log_t,
> cluster_var_run_t, clvmd_var_run_t, cmirrord_var_run_t,
> cobbler_var_log_t, cockpit_unit_file_t, collectd_unit_file_t,
> collectd_var_run_t, colord_unit_file_t, comsat_var_run_t,
> condor_log_t, condor_unit_file_t, condor_var_run_t, conman_log_t,
> conman_unit_file_t, conman_var_run_t, consolekit_log_t,
> consolekit_unit_file_t, consolekit_var_run_t, couchdb_log_t,
> couchdb_unit_file_t, couchdb_var_run_t, courier_var_run_t,
> cpuplug_var_run_t, cpuspeed_var_run_t, cron_log_t, cron_var_run_t,
> crond_unit_file_t, crond_var_run_t, ctdbd_log_t, ctdbd_var_run_t,
> cupsd_config_var_run_t, cupsd_log_t, cupsd_lpd_var_run_t,
> cupsd_unit_file_t, cupsd_var_run_t, cvs_var_run_t, cyphesis_log_t,
> cyphesis_var_run_t, cyrus_var_run_t, dbskkd_var_run_t, dbusd_etc_t,
> dcc_var_run_t, dccd_var_run_t, dccifd_var_run_t, dccm_var_run_t,
> dcerpcd_var_run_t, ddclient_log_t, ddclient_var_run_t,
> deltacloudd_log_t, deltacloudd_var_run_t, denyhosts_var_log_t,
> device_t, devicekit_var_log_t, devicekit_var_run_t, dhcpc_var_run_t,
> dhcpd_unit_file_t, dhcpd_var_run_t, dictd_var_run_t,
> dirsrv_snmp_var_log_t, dirsrv_snmp_var_run_t, dirsrv_var_log_t,
> dirsrv_var_run_t, dkim_milter_data_t, dlm_controld_var_log_t,
> dlm_controld_var_run_t, dnsmasq_unit_file_t, dnsmasq_var_log_t,
> dnsmasq_var_run_t, dnssec_trigger_var_run_t, docker_log_t,
> docker_unit_file_t, docker_var_run_t, dovecot_var_log_t,
> dovecot_var_run_t, dspam_log_t, dspam_var_run_t, entropyd_var_run_t,
> etc_runtime_t, etc_t, eventlogd_var_run_t, evtchnd_var_log_t,
> evtchnd_var_run_t, exim_log_t, exim_var_run_t, fail2ban_log_t,
> fail2ban_var_run_t, faillog_t, fcoemon_var_run_t, fenced_var_log_t,
> fenced_var_run_t, fetchmail_log_t, fetchmail_var_run_t,
> file_context_t, fingerd_log_t, fingerd_var_run_t,
> firewalld_unit_file_t, firewalld_var_log_t, firewalld_var_run_t,
> foghorn_var_log_t, foghorn_var_run_t, fonts_cache_t, fonts_t,
> freeipmi_bmc_watchdog_unit_file_t, freeipmi_bmc_watchdog_var_run_t,
> freeipmi_ipmidetectd_unit_file_t, freeipmi_ipmidetectd_var_run_t,
> freeipmi_ipmiseld_unit_file_t, freeipmi_ipmiseld_var_run_t,
> fsadm_log_t, fsadm_var_run_t, fsdaemon_var_run_t, ftpd_unit_file_t,
> ftpd_var_run_t, games_srv_var_run_t, gdomap_var_run_t, gear_log_t,
> gear_unit_file_t, gear_var_run_t, getty_log_t, getty_unit_file_t,
> getty_var_run_t, gfs_controld_var_log_t, gfs_controld_var_run_t,
> glance_api_unit_file_t, glance_log_t, glance_registry_unit_file_t,
> glance_scrubber_unit_file_t, glance_var_run_t, glusterd_log_t,
> glusterd_var_run_t, gpm_var_run_t, gpsd_var_run_t,
> greylist_milter_data_t, groupd_var_log_t, groupd_var_run_t,
> gssproxy_unit_file_t, gssproxy_var_run_t, haproxy_unit_file_t,
> haproxy_var_log_t, haproxy_var_run_t, httpd_config_t, httpd_log_t,
> httpd_sys_rw_content_t, httpd_unit_file_t, httpd_var_run_t, hwdata_t,
> hypervkvp_unit_file_t, hypervvssd_unit_file_t, icecast_log_t,
> icecast_var_run_t, ifconfig_var_run_t, inetd_child_var_run_t,
> inetd_log_t, inetd_var_run_t, init_var_run_t, initrc_var_log_t,
> initrc_var_run_t, innd_log_t, innd_var_run_t, insmod_var_run_t,
> iodined_unit_file_t, ipa_otpd_unit_file_t, ipsec_log_t,
> ipsec_mgmt_unit_file_t, ipsec_mgmt_var_run_t, ipsec_var_run_t,
> iptables_unit_file_t, iptables_var_run_t, irqbalance_var_run_t,
> iscsi_log_t, iscsi_unit_file_t, iscsi_var_run_t, isnsd_var_run_t,
> iwhd_log_t, iwhd_var_run_t, jetty_log_t, jetty_var_run_t,
> jockey_var_log_t, kadmind_log_t, kadmind_var_run_t, kdump_unit_file_t,
> keepalived_unit_file_t, keepalived_var_run_t, keystone_log_t,
> keystone_unit_file_t, keystone_var_run_t, kismet_log_t,
> kismet_var_run_t, klogd_var_run_t, kmscon_unit_file_t, krb5kdc_log_t,
> krb5kdc_var_run_t, ksmtuned_log_t, ksmtuned_unit_file_t,
> ksmtuned_var_run_t, ktalkd_log_t, ktalkd_unit_file_t, l2tpd_var_run_t,
> lastlog_t, lib_t, lircd_var_run_t, lldpad_var_run_t, locale_t,
> locate_var_run_t, logrotate_tmp_t, logrotate_var_lib_t,
> logwatch_var_run_t, lpd_var_run_t, lsassd_var_run_t, lsmd_unit_file_t,
> lsmd_var_run_t, lvm_unit_file_t, lvm_var_run_t, lwiod_var_run_t,
> lwregd_var_run_t, lwsmd_var_run_t, mailman_log_t, mailman_var_run_t,
> man_cache_t, man_t, mcelog_log_t, mcelog_var_run_t, mdadm_unit_file_t,
> mdadm_var_run_t, memcached_var_run_t, minidlna_log_t,
> minidlna_var_run_t, minissdpd_var_run_t, mip6d_unit_file_t,
> mirrormanager_log_t, mirrormanager_var_run_t, mock_var_run_t,
> modemmanager_unit_file_t, mon_statd_var_run_t, mongod_log_t,
> mongod_var_run_t, motion_log_t, motion_unit_file_t, motion_var_run_t,
> mount_var_run_t, mpd_log_t, mpd_var_run_t, mrtg_log_t, mrtg_var_run_t,
> mscan_var_run_t, munin_etc_t, munin_log_t, munin_var_run_t,
> mysqld_etc_t, mysqld_log_t, mysqld_unit_file_t, mysqld_var_run_t,
> mysqlmanagerd_var_run_t, mythtv_var_log_t, naemon_log_t,
> naemon_var_run_t, nagios_log_t, nagios_var_run_t, named_cache_t,
> named_log_t, named_unit_file_t, named_var_run_t, net_conf_t,
> netlabel_mgmt_unit_file_t, netlogond_var_run_t, neutron_log_t,
> neutron_unit_file_t, neutron_var_run_t, nfsd_unit_file_t,
> ninfod_run_t, ninfod_unit_file_t, nis_unit_file_t, nmbd_var_run_t,
> nova_ajax_unit_file_t, nova_api_unit_file_t, nova_cert_unit_file_t,
> nova_compute_unit_file_t, nova_conductor_unit_file_t,
> nova_console_unit_file_t, nova_direct_unit_file_t, nova_log_t,
> nova_network_unit_file_t, nova_objectstore_unit_file_t,
> nova_scheduler_unit_file_t, nova_var_run_t, nova_vncproxy_unit_file_t,
> nova_volume_unit_file_t, nrpe_var_run_t, nscd_log_t, nscd_unit_file_t,
> nscd_var_run_t, nsd_var_run_t, nslcd_var_run_t, ntop_var_run_t,
> ntpd_log_t, ntpd_unit_file_t, ntpd_var_run_t, numad_unit_file_t,
> numad_var_log_t, numad_var_run_t, nut_unit_file_t, nut_var_run_t,
> nx_server_var_run_t, oddjob_unit_file_t, oddjob_var_run_t,
> openct_var_run_t, openhpid_var_run_t, openshift_log_t,
> openshift_var_lib_t, openshift_var_run_t, opensm_log_t,
> opensm_unit_file_t, openvpn_status_t, openvpn_var_log_t,
> openvpn_var_run_t, openvswitch_log_t, openvswitch_unit_file_t,
> openvswitch_var_run_t, openwsman_log_t, openwsman_run_t,
> openwsman_unit_file_t, osad_log_t, osad_var_run_t, pads_var_run_t,
> pam_var_console_t, pam_var_run_t, passenger_log_t,
> passenger_var_run_t, pcp_log_t, pcp_var_run_t, pcscd_var_run_t,
> pegasus_openlmi_storage_var_run_t, pegasus_var_run_t,
> pesign_unit_file_t, pesign_var_run_t, phc2sys_unit_file_t,
> piranha_fos_var_run_t, piranha_log_t, piranha_lvs_var_run_t,
> piranha_pulse_var_run_t, piranha_web_var_run_t, pkcs_slotd_var_run_t,
> pki_ra_log_t, pki_ra_var_run_t, pki_tomcat_log_t,
> pki_tomcat_unit_file_t, pki_tomcat_var_run_t, pki_tps_log_t,
> pki_tps_var_run_t, plymouthd_var_log_t, plymouthd_var_run_t,
> policykit_var_run_t, polipo_log_t, polipo_pid_t, polipo_unit_file_t,
> portmap_var_run_t, portreserve_var_run_t, postfix_postdrop_t,
> postfix_var_run_t, postgresql_log_t, postgresql_var_run_t,
> postgrey_var_run_t, power_unit_file_t, pppd_log_t, pppd_unit_file_t,
> pppd_var_run_t, pptp_log_t, pptp_var_run_t, prelink_log_t,
> prelude_audisp_var_run_t, prelude_lml_var_run_t, prelude_log_t,
> prelude_var_run_t, privoxy_log_t, privoxy_var_run_t, proc_t,
> procmail_log_t, prosody_unit_file_t, prosody_var_run_t,
> psad_var_log_t, psad_var_run_t, ptal_var_run_t, ptp4l_unit_file_t,
> pulseaudio_var_run_t, puppet_log_t, puppet_var_run_t,
> pwauth_var_run_t, pyicqt_log_t, pyicqt_var_run_t, qdiskd_var_log_t,
> qdiskd_var_run_t, qemu_var_run_t, qpidd_var_run_t,
> quota_nld_var_run_t, rabbitmq_unit_file_t, rabbitmq_var_log_t,
> rabbitmq_var_run_t, radiusd_log_t, radiusd_unit_file_t,
> radiusd_var_run_t, radvd_var_run_t, rasdaemon_unit_file_t,
> rdisc_unit_file_t, readahead_var_run_t, redis_log_t,
> redis_unit_file_t, redis_var_run_t, regex_milter_data_t,
> restorecond_var_run_t, rhev_agentd_log_t, rhev_agentd_unit_file_t,
> rhev_agentd_var_run_t, rhnsd_unit_file_t, rhnsd_var_run_t,
> rhsmcertd_log_t, rhsmcertd_var_run_t, ricci_modcluster_var_log_t,
> ricci_modcluster_var_run_t, ricci_var_log_t, ricci_var_run_t,
> rlogind_var_run_t, rngd_unit_file_t, rngd_var_run_t,
> rolekit_unit_file_t, root_t, roundup_var_run_t, rpcbind_var_run_t,
> rpcd_unit_file_t, rpcd_var_run_t, rpm_log_t, rpm_var_cache_t,
> rpm_var_run_t, rsync_log_t, rsync_var_run_t, rtas_errd_log_t,
> rtas_errd_unit_file_t, rtas_errd_var_run_t, samba_etc_t, samba_log_t,
> samba_unit_file_t, sanlock_log_t, sanlock_unit_file_t,
> sanlock_var_run_t, saslauthd_var_run_t, sblim_var_run_t,
> screen_var_run_t, sectool_var_log_t, security_t, sendmail_log_t,
> sendmail_var_run_t, sensord_log_t, sensord_unit_file_t,
> sensord_var_run_t, setrans_var_run_t, setroubleshoot_var_log_t,
> setroubleshoot_var_run_t, shell_exec_t, shorewall_log_t, slapd_log_t,
> slapd_unit_file_t, slapd_var_run_t, slpd_log_t, slpd_var_run_t,
> smbd_var_run_t, smokeping_var_run_t, smsd_log_t, smsd_var_run_t,
> snapperd_log_t, snmpd_log_t, snmpd_var_run_t, snort_log_t,
> snort_var_run_t, sosreport_var_run_t, soundd_var_run_t,
> spamass_milter_data_t, spamd_log_t, spamd_var_run_t,
> speech-dispatcher_log_t, speech-dispatcher_unit_file_t, squid_log_t,
> squid_var_run_t, src_t, srvsvcd_var_run_t, sshd_keygen_unit_file_t,
> sshd_unit_file_t, sshd_var_run_t, sssd_public_t, sssd_unit_file_t,
> sssd_var_log_t, sssd_var_run_t, stapserver_log_t,
> stapserver_var_run_t, stunnel_var_run_t, svnserve_unit_file_t,
> svnserve_var_run_t, swat_var_run_t, swift_unit_file_t,
> swift_var_run_t, sysfs_t, syslogd_var_run_t, sysstat_log_t,
> system_conf_t, system_cronjob_var_run_t, system_db_t,
> system_dbusd_var_run_t, systemd_logind_inhibit_var_run_t,
> systemd_logind_sessions_t, systemd_logind_var_run_t,
> systemd_networkd_unit_file_t, systemd_networkd_var_run_t,
> systemd_passwd_var_run_t, systemd_runtime_unit_file_t,
> systemd_unit_file_t, systemd_vconsole_unit_file_t, telnetd_var_run_t,
> textrel_shlib_t, tftpd_var_run_t, tgtd_var_run_t,
> thin_aeolus_configserver_log_t, thin_aeolus_configserver_var_run_t,
> thin_log_t, thin_var_run_t, timemaster_unit_file_t,
> timemaster_var_run_t, tmp_t, tomcat_log_t, tomcat_unit_file_t,
> tomcat_var_run_t, tor_unit_file_t, tor_var_log_t, tor_var_run_t,
> tuned_log_t, tuned_var_run_t, udev_var_run_t, ulogd_var_log_t,
> uml_switch_var_run_t, usbmuxd_unit_file_t, usbmuxd_var_run_t,
> user_home_dir_t, useradd_var_run_t, usr_t, uucpd_log_t,
> uucpd_var_run_t, uuidd_var_run_t, var_lib_t, var_lock_t, var_log_t,
> var_run_t, var_spool_t, varnishd_var_run_t, varnishlog_log_t,
> varnishlog_var_run_t, vdagent_log_t, vdagent_var_run_t,
> vhostmd_var_run_t, virt_cache_t, virt_log_t, virt_lxc_var_run_t,
> virt_qemu_ga_log_t, virt_qemu_ga_var_run_t, virt_var_run_t,
> virtd_unit_file_t, vmtools_unit_file_t, vmware_host_pid_t,
> vmware_log_t, vmware_pid_t, vnstatd_var_run_t, vpnc_var_run_t,
> watchdog_log_t, watchdog_var_run_t, wdmd_var_run_t, winbind_log_t,
> winbind_var_run_t, wtmp_t, xdm_log_t, xdm_var_run_t,
> xenconsoled_var_run_t, xend_var_log_t, xend_var_run_t,
> xenstored_var_log_t, xenstored_var_run_t, xferlog_t, xserver_log_t,
> xserver_var_run_t, ypbind_unit_file_t, ypbind_var_run_t,
> yppasswdd_var_run_t, ypserv_var_run_t, ypxfr_var_run_t, zabbix_log_t,
> zabbix_var_run_t, zarafa_deliver_log_t, zarafa_deliver_var_run_t,
> zarafa_gateway_log_t, zarafa_gateway_var_run_t, zarafa_ical_log_t,
> zarafa_ical_var_run_t, zarafa_indexer_log_t, zarafa_indexer_var_run_t,
> zarafa_monitor_log_t, zarafa_monitor_var_run_t, zarafa_server_log_t,
> zarafa_server_var_run_t, zarafa_spooler_log_t,
> zarafa_spooler_var_run_t, zebra_log_t, zebra_unit_file_t,
> zebra_var_run_t, zoneminder_log_t, zoneminder_unit_file_t,
> zoneminder_var_run_t.
> Then execute:
> restorecon -v '/var/cache/dnf'
>
>
> ***** Plugin catchall (1.44 confidence) suggests
> **************************
>
> If you believe that logrotate should be allowed read access on the dnf
> directory by default.
> Then you should report this as a bug.
> You can generate a local policy module to allow this access.
> Do
> allow this access for now by executing:
> # grep logrotate /var/log/audit/audit.log | audit2allow -M mypol
> # semodule -i mypol.pp
>
> Additional Information:
> Source Context system_u:system_r:logrotate_t:s0-s0:c0.c1023
> Target Context unconfined_u:object_r:var_t:s0
> Target Objects /var/cache/dnf [ dir ]
> Source logrotate
> Source Path logrotate
> Port <Unknown>
> Host Jehovah.local
> Source RPM Packages
> Target RPM Packages
> Policy RPM selinux-policy-3.13.1-103.fc21.noarch
> Selinux Enabled True
> Policy Type targeted
> Enforcing Mode Enforcing
> Host Name Jehovah.local
> Platform Linux Jehovah.local 3.17.6-300.fc21.x86_64 #1 SMP
> Mon Dec 8 22:29:32 UTC 2014 x86_64 x86_64
> Alert Count 4
> First Seen 2014-12-18 06:08:01 MST
> Last Seen 2014-12-21 05:37:01 MST
> Local ID 473bcbf8-1305-4711-823e-5f9ae4b46070
>
> Raw Audit Messages
> type=AVC msg=audit(1419165421.976:453): avc: denied { read } for
> pid=6494 comm="logrotate" name="dnf" dev="sda3" ino=142352
> scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023
> tcontext=unconfined_u:object_r:var_t:s0 tclass=dir permissive=0
>
>
> Hash: logrotate,logrotate_t,var_t,dir,read
>