Browse Source

Move tmpwatch from cron.daily to actual root crontab

It appeary running the tmpwatch from the cron.daily location isn't
possible: the way cron/anacron is running things appears to break
SELinux context at some point, leading to SELinux denials caused by a
weird need for dac_override.

In order to NOT allow this dac_override (security hazard), and after
extensive testing, it seems it's better to push the job directly in
root's crontab.

Change-Id: Ib7e1d47fe7cffa2bd2ed1d72d94e4f380162f10a
Closes-Bug: #1922002
Resolves: rhbz#1944466
(cherry picked from commit 1c7657b00b)
changes/81/784081/1
Cédric Jeanneret 3 weeks ago
committed by Kevin Carter
parent
commit
2851c49d0e
1 changed files with 30 additions and 15 deletions
  1. +30
    -15
      deployment/logrotate/logrotate-crond-container-puppet.yaml

+ 30
- 15
deployment/logrotate/logrotate-crond-container-puppet.yaml View File

@ -107,21 +107,36 @@ outputs:
deploy_steps_tasks:
- name: configure tmpwatch on the host
when: step|int == 2
copy:
dest: /etc/cron.daily/containers-tmpwatch
owner: root
group: root
mode: 0755
content: |
#!/bin/sh
tmpwatch --nodirs \
-X "/var/log/containers/*/*log" \
-X "/var/log/containers/*/*/*log" \
-X "/var/log/containers/*/*err" \
{{ LogrotatePurgeAfterDays|int +1 }}d \
/var/log/containers/ 2>&1 | logger -t container-tmpwatch
vars:
LogrotatePurgeAfterDays: {get_param: LogrotatePurgeAfterDays}
block:
- name: Push script
copy:
dest: /usr/local/sbin/containers-tmpwatch
owner: root
group: root
mode: 0755
content: |
#!/bin/sh
tmpwatch --nodirs \
-X "/var/log/containers/*/*log" \
-X "/var/log/containers/*/*/*log" \
-X "/var/log/containers/*/*err" \
{{ LogrotatePurgeAfterDays|int +1 }}d \
/var/log/containers/ 2>&1 | logger -t container-tmpwatch
vars:
LogrotatePurgeAfterDays: {get_param: LogrotatePurgeAfterDays}
- name: Insert cronjob in root crontab
cron:
name: "Remove old logs"
special_time: "daily"
user: "root"
job: "/usr/local/sbin/containers-tmpwatch"
update_tasks: &tmpwatch_script_clean
- name: Ensure old cron.daily is absent
when: step|int == 1
file:
path: /etc/cron.daily/containers-tmpwatch
state: absent
upgrade_tasks: *tmpwatch_script_clean
# BEGIN DOCKER SETTINGS
puppet_config:
config_volume: crond


Loading…
Cancel
Save