Move tmpwatch from cron.daily to actual root crontab
It appeary running the tmpwatch from the cron.daily location isn't
possible: the way cron/anacron is running things appears to break
SELinux context at some point, leading to SELinux denials caused by a
weird need for dac_override.
In order to NOT allow this dac_override (security hazard), and after
extensive testing, it seems it's better to push the job directly in
root's crontab.
Change-Id: Ib7e1d47fe7cffa2bd2ed1d72d94e4f380162f10a
Closes-Bug: #1922002
Resolves: rhbz#1944466
(cherry picked from commit 1c7657b00b
)
This commit is contained in:
parent
50ee8c1cba
commit
5325ac3116
|
@ -107,21 +107,36 @@ outputs:
|
|||
deploy_steps_tasks:
|
||||
- name: configure tmpwatch on the host
|
||||
when: step|int == 2
|
||||
copy:
|
||||
dest: /etc/cron.daily/containers-tmpwatch
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0755
|
||||
content: |
|
||||
#!/bin/sh
|
||||
tmpwatch --nodirs \
|
||||
-X "/var/log/containers/*/*log" \
|
||||
-X "/var/log/containers/*/*/*log" \
|
||||
-X "/var/log/containers/*/*err" \
|
||||
{{ LogrotatePurgeAfterDays|int +1 }}d \
|
||||
/var/log/containers/ 2>&1 | logger -t container-tmpwatch
|
||||
vars:
|
||||
LogrotatePurgeAfterDays: {get_param: LogrotatePurgeAfterDays}
|
||||
block:
|
||||
- name: Push script
|
||||
copy:
|
||||
dest: /usr/local/sbin/containers-tmpwatch
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0755
|
||||
content: |
|
||||
#!/bin/sh
|
||||
tmpwatch --nodirs \
|
||||
-X "/var/log/containers/*/*log" \
|
||||
-X "/var/log/containers/*/*/*log" \
|
||||
-X "/var/log/containers/*/*err" \
|
||||
{{ LogrotatePurgeAfterDays|int +1 }}d \
|
||||
/var/log/containers/ 2>&1 | logger -t container-tmpwatch
|
||||
vars:
|
||||
LogrotatePurgeAfterDays: {get_param: LogrotatePurgeAfterDays}
|
||||
- name: Insert cronjob in root crontab
|
||||
cron:
|
||||
name: "Remove old logs"
|
||||
special_time: "daily"
|
||||
user: "root"
|
||||
job: "/usr/local/sbin/containers-tmpwatch"
|
||||
update_tasks: &tmpwatch_script_clean
|
||||
- name: Ensure old cron.daily is absent
|
||||
when: step|int == 1
|
||||
file:
|
||||
path: /etc/cron.daily/containers-tmpwatch
|
||||
state: absent
|
||||
upgrade_tasks: *tmpwatch_script_clean
|
||||
# BEGIN DOCKER SETTINGS
|
||||
puppet_config:
|
||||
config_volume: crond
|
||||
|
|
Loading…
Reference in New Issue