logrotate is unable to rotate a log file for our application on CentOS 7. This appears to be because of this AVC error:

type=AVC msg=audit(1441112694.305:19502): avc:  denied  { write } for  pid=9146 comm="logrotate" name="autuitive.log" dev="xvda1" ino=26262388 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:usr_t:s0 tclass=file

I passed the error to the audit2allow utility to create a rule to allow it, but when I try to enable the rule, I get the following error:

[root@app1 ~]# semodule -i logrotate.pp
libsepol.print_missing_requirements: logrotate's global requirements were not met: type/attribute logrotate_t (No such file or directory).
libsemanage.semanage_link_sandbox: Link packages failed (No such file or directory).
semodule:  Failed!

Here is the rule itself that was generated:

[root@app1 ~]# cat logrotate.te 

module logrotate 1.0;

require {
    type logrotate_t;
    type usr_t;
    class file write;

#============= logrotate_t ==============
allow logrotate_t usr_t:file write;

I think this is caused because there will already be a logrotate.pp file on the system (/etc/selinux/targeted/modules/active/modules/logrotate.pp).

You should create your local policy with a different name e.g.

audit2allow -M MY_logrotate <somefilewithmessages

then use

semodule -i MY_logrotate.pp 

to install it. Yeah it's not the best of error messages.

  • This was 100% correct. Resolved the issue, thanks! – Soviero Sep 1 '15 at 14:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.