Move tmpwatch from cron.daily to actual root crontab
It appeary running the tmpwatch from the cron.daily location isn't possible: the way cron/anacron is running things appears to break SELinux context at some point, leading to SELinux denials caused by a weird need for dac_override. In order to NOT allow this dac_override (security hazard), and after extensive testing, it seems it's better to push the job directly in root's crontab. Change-Id: Ib7e1d47fe7cffa2bd2ed1d72d94e4f380162f10a Closes-Bug: #1922002 Resolves: rhbz#1944466
This commit is contained in:
parent
0e97b71fdb
commit
1c7657b00b
|
@ -104,8 +104,10 @@ outputs:
|
|||
deploy_steps_tasks:
|
||||
- name: configure tmpwatch on the host
|
||||
when: step|int == 2
|
||||
block:
|
||||
- name: Push script
|
||||
copy:
|
||||
dest: /etc/cron.daily/containers-tmpwatch
|
||||
dest: /usr/local/sbin/containers-tmpwatch
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0755
|
||||
|
@ -119,6 +121,19 @@ outputs:
|
|||
/var/log/containers/ 2>&1 | logger -t container-tmpwatch
|
||||
vars:
|
||||
LogrotatePurgeAfterDays: {get_param: LogrotatePurgeAfterDays}
|
||||
- name: Insert cronjob in root crontab
|
||||
cron:
|
||||
name: "Remove old logs"
|
||||
special_time: "daily"
|
||||
user: "root"
|
||||
job: "/usr/local/sbin/containers-tmpwatch"
|
||||
update_tasks: &tmpwatch_script_clean
|
||||
- name: Ensure old cron.daily is absent
|
||||
when: step|int == 1
|
||||
file:
|
||||
path: /etc/cron.daily/containers-tmpwatch
|
||||
state: absent
|
||||
upgrade_tasks: *tmpwatch_script_clean
|
||||
# BEGIN DOCKER SETTINGS
|
||||
puppet_config:
|
||||
config_volume: crond
|
||||
|
|
Loading…
Reference in New Issue