Move tmpwatch from cron.daily to actual root crontab

It appeary running the tmpwatch from the cron.daily location isn't
possible: the way cron/anacron is running things appears to break
SELinux context at some point, leading to SELinux denials caused by a
weird need for dac_override.

In order to NOT allow this dac_override (security hazard), and after
extensive testing, it seems it's better to push the job directly in
root's crontab.

Change-Id: Ib7e1d47fe7cffa2bd2ed1d72d94e4f380162f10a
Closes-Bug: #1922002
Resolves: rhbz#1944466

deployment/logrotate/logrotate-crond-container-puppet.yaml

@@ -104,21 +104,36 @@ outputs:
       deploy_steps_tasks:
         - name: configure tmpwatch on the host
           when: step|int == 2
-          copy:
+          block:
-            dest: /etc/cron.daily/containers-tmpwatch
+            - name: Push script
-            owner: root
+              copy:
-            group: root
+                dest: /usr/local/sbin/containers-tmpwatch
-            mode: 0755
+                owner: root
-            content: |
+                group: root
-              #!/bin/sh
+                mode: 0755
-              tmpwatch --nodirs \
+                content: |
-                -X "/var/log/containers/*/*log" \
+                  #!/bin/sh
-                -X "/var/log/containers/*/*/*log" \
+                  tmpwatch --nodirs \
-                -X "/var/log/containers/*/*err" \
+                    -X "/var/log/containers/*/*log" \
-                {{ LogrotatePurgeAfterDays|int +1 }}d \
+                    -X "/var/log/containers/*/*/*log" \
-                /var/log/containers/ 2>&1 | logger -t container-tmpwatch
+                    -X "/var/log/containers/*/*err" \
-          vars:
+                    {{ LogrotatePurgeAfterDays|int +1 }}d \
-             LogrotatePurgeAfterDays: {get_param: LogrotatePurgeAfterDays}
+                    /var/log/containers/ 2>&1 | logger -t container-tmpwatch
+              vars:
+                 LogrotatePurgeAfterDays: {get_param: LogrotatePurgeAfterDays}
+            - name: Insert cronjob in root crontab
+              cron:
+                name: "Remove old logs"
+                special_time: "daily"
+                user: "root"
+                job: "/usr/local/sbin/containers-tmpwatch"
+      update_tasks: &tmpwatch_script_clean
+        - name: Ensure old cron.daily is absent
+          when: step|int == 1
+          file:
+            path: /etc/cron.daily/containers-tmpwatch
+            state: absent
+      upgrade_tasks: *tmpwatch_script_clean
       # BEGIN DOCKER SETTINGS
       puppet_config:
         config_volume: crond