1

I'm using backup software called UrBackup, which I've configured to rotate its logs once a day through cron.daily. After the logs are rotated, the software uses a postrotate script to send the running process a HUP signal with "systemctl kill". However, SELinux is denying this operation, and I can't figure out how to fix it.

Here is the entire logrotate config file for UrBackup from /etc/logrotate.d:

"/var/log/urbackup.log" {
        daily
        rotate 30
        missingok
        create 640 urbackup urbackup
        compress
        postrotate
                test -e /var/run/urbackupsrv.pid && kill -HUP 'cat /var/run/urbackupsrv.pid' || /bin/systemctl kill -s HUP urbackup-server.service
        endscript
}

As I've found, the following problematic postrotate script is being executed on the system:

/bin/systemctl kill -s HUP urbackup-server.service

SELinux is blocking this. Here is the relevant log entry from /var/log/messages:

Nov 14 03:33:33 backup4 kernel: type=1107 audit(1510648413.518:4407695): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  denied  { stop } for auid=0 uid=0 gid=0 path="/usr/lib/systemd/system/urbackup-server.service" cmdline="/bin/systemctl kill -s HUP urbackup-server.service" scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:systemd_unit_file_t:s0 tclass=service#012 exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'

Nov 14 03:33:33 backup4 logrotate: ALERT exited abnormally with [1]

Because the HUP signal is not sent to the service, it doesn't know that the logfiles have been rotated, and it continues writing indefinitely into an old (rotated) log.

I tried to troubleshoot this using the sealert utility to provide an explanation of all errors in /var/log/audit/audit.log. However, it appears to ignore this error, even though the log entry appears in audit.log.

I also tried running the "systemctl kill" command interactively as root. It completes without any error. The same goes for a manual running of logrotate:

logrotate -f /etc/logrotate.d/urbackup-server

That command also runs without problems. The only time I'm seeing the SELinux denial is when logrotate is triggered by the daily Anacron process.

Is the "systemctl kill" command explicitly not allowed by SELinux? If so, why can I run it interactively, but not when started through cron? Is there any way I can add an exception for this case, or another way I can send the HUP signal to the process so it will write into the correct log file?

Thank you very much for any assistance.

1

Specifically, context logrotate_t is not allowed systemd_unit_file_t. Your interactive run of it is in a different context.

Curious that it fell through the pid file test. If that pid file does not exist while the service is running, try adding PIDFile=/var/run/urbackupsrv.pid to the urbackup-server.service unit.

There are ways to define domain transition in SELinux, but give the pid file thing a go first.

  • Thanks a lot for the helpful comment. I didn't know how to find out whether the logrotate process was allowed to act on systemd unit files. SELinux is still mysterious to me :-). I'll definitely look more closely at the pid issue to see what's going on there. – A.J. Nov 19 '17 at 21:19
  • Short update: According to the developer, the pid file isn't generated when the process is started with systemd -- it's only used for systems with the SysV-style init system. The developer suggests that I instead try using the postrotate command kill -HUP $(pidof urbackupsrv). I don't know if this will run into the same SELinux issue, but I'm trying it now. – A.J. Nov 19 '17 at 23:34
  • It appears the fix is to use the following postrotate command: /usr/bin/kill -HUP $(pidof urbackupsrv). Apparently this doesn't run into any SELinux restrictions, whereas the similar systemctl kill command will. Thank you for your valuable help. – A.J. Nov 20 '17 at 11:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.