logrotate errors

[Aaron Ross]

Hi all,

I am having some problems with logrotate on a box with selinux enabled. 
Here's my current sestatus:

[root@customer bin]# /usr/sbin/sestatus -v
SELinux status:         enabled
SELinuxfs mount:        /selinux
Current mode:           permissive
Policy version:         17

Policy booleans:
user_ping               inactive

Process contexts:
Current context:        root:sysadm_r:sysadm_t
Init context:           system_u:system_r:kernel_t
/sbin/mingetty          system_u:system_r:kernel_t
/usr/sbin/sshd          system_u:system_r:kernel_t

File contexts:
Controlling term:       root:object_r:devpts_t
/etc/passwd             root:object_r:file_t
/etc/shadow             root:object_r:file_t

And here is an example of the errors I'm seeing:

error: error getting file context /usr/local/apache/logs/access_log: No 
data available

I've read the FAQ and I'll keep going through the introductions to 
SELinux, but if I could get a quick explanation of what's going wrong, I 
would be very grateful.

Thanks, Aaron

[Stephen Smalley]

On Thu, 2004-07-01 at 09:51, Aaron Ross wrote:
>  Process contexts:
>  Current context:        root:sysadm_r:sysadm_t
>  Init context:           system_u:system_r:kernel_t
>  /sbin/mingetty          system_u:system_r:kernel_t
>  /usr/sbin/sshd          system_u:system_r:kernel_t
>  
>  File contexts:
>  Controlling term:       root:object_r:devpts_t
>  /etc/passwd             root:object_r:file_t
>  /etc/shadow             root:object_r:file_t 
This means that you haven't labeled your filesystems.  Run 'fixfiles
relabel' and reboot.

>  And here is an example of the errors I'm seeing:
>  
>  error: error getting file context /usr/local/apache/logs/access_log: No 
>  data available 
The file has no security context assigned, so logrotate is unable to get
the context of the log prior to rotation in order to preserve it.

-- 
Stephen Smalley <sds(a)epoch.ncsc.mil&gt;
National Security Agency