rsyncd can't open log file, but there are no avc messages

Johnny Tan linuxweb at gmail.com
Tue Jun 24 15:09:13 UTC 2008


I'm stumped.

I run a Java app called Solr, which does search indexing. My 
solr server creates the index, then I have a bunch of solr 
clients that rsync that index over.

The rsync itself is fine, that works. The problem is it 
won't write to the appropriate logfile, which is:
/opt/solr/logs/rsyncd.log

/opt/solr/logs is a symlink to /var/log/store.

Here's how it looks:

==

[root at solr:~]# ls -l /opt/solr/
lrwxrwxrwx  1 tomcat tomcat   14 Apr 29 13:52 logs -> 
/var/log/store

[root at solr:~]# ls -ldZ /opt/solr/logs/
drwxr-xr-x  tomcat tomcat user_u:object_r:var_log_t 
/opt/solr/logs/

[root at solr:~]# ls -ldZ /var/log/store
drwxr-xr-x  tomcat tomcat user_u:object_r:var_log_t 
/var/log/store

[root at solr:~]# ls -Z /opt/solr/logs/rsyncd.log
-rw-rw-rw-  tomcat tomcat user_u:object_r:var_log_t 
/var/log/store/rsyncd.log

==

Note that the mode is 666 on the rsyncd.log. When a client 
tries to connect, though, I get, in /var/log/messages:

Jun 24 10:15:02 solr rsyncd[19355]: rsync: failed to open 
log-file /opt/solr/logs/rsyncd.log: Permission denied (13)

But there are no avc denials (no, I don't have audit package 
installed, so all avc messages go to /var/log/messages -- I 
do get avc denials for other things).

So, at first, I didn't think it was selinux-related, and 
tried to troubleshoot general unix permissions. But got nowhere.

Then I noticed... when I put selinux in permissive mode, it 
works -- rsyncd properly logs to the above file. When I set 
it back to enforcing, I get the above error in 
/var/log/messages and nothing in the rsyncd.log, but no avc 
denials either.


Any ideas?

If it helps, here's how my rsyncd module looks like:
==

module solrrsync 1.0;

require {
         type initrc_tmp_t;
         type port_t;
         type var_log_t;
         type restorecon_t;
         type rsync_t;
         type usr_t;
         class netlink_route_socket { read create bind 
getattr write nlmsg_read };
         class lnk_file read;
         class file { read write getattr create append };
         class tcp_socket { name_connect name_bind };
         class dir { write add_name };
}

#============= restorecon_t ==============
allow restorecon_t initrc_tmp_t:file { read write };
allow restorecon_t usr_t:lnk_file read;
allow restorecon_t var_log_t:lnk_file read;

#============= rsync_t ==============
allow rsync_t initrc_tmp_t:file { read write };
allow rsync_t port_t:tcp_socket { name_connect name_bind };
allow rsync_t self:netlink_route_socket { read create bind 
getattr write nlmsg_read };
allow rsync_t usr_t:lnk_file read;
allow rsync_t usr_t:file { read getattr };
allow rsync_t var_log_t:lnk_file read;
allow rsync_t var_log_t:dir { write add_name };
allow rsync_t var_log_t:file { read write getattr create 
append };





More information about the fedora-selinux-list mailing list