{"action":"created","issue":{"url":"https://api.github.com/repos/openshift/origin-aggregated-logging/issues/89","repository_url":"https://api.github.com/repos/openshift/origin-aggregated-logging","labels_url":"https://api.github.com/repos/openshift/origin-aggregated-logging/issues/89/labels{/name}","comments_url":"https://api.github.com/repos/openshift/origin-aggregated-logging/issues/89/comments","events_url":"https://api.github.com/repos/openshift/origin-aggregated-logging/issues/89/events","html_url":"https://github.com/openshift/origin-aggregated-logging/issues/89","id":140041352,"number":89,"title":"fluentd does not work with hostmount-anyuid with SELinux Enforcing","user":{"login":"richm","id":23066,"avatar_url":"https://avatars.githubusercontent.com/u/23066?v=3","gravatar_id":"","url":"https://api.github.com/users/richm","html_url":"https://github.com/richm","followers_url":"https://api.github.com/users/richm/followers","following_url":"https://api.github.com/users/richm/following{/other_user}","gists_url":"https://api.github.com/users/richm/gists{/gist_id}","starred_url":"https://api.github.com/users/richm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/richm/subscriptions","organizations_url":"https://api.github.com/users/richm/orgs","repos_url":"https://api.github.com/users/richm/repos","events_url":"https://api.github.com/users/richm/events{/privacy}","received_events_url":"https://api.github.com/users/richm/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-03-10T23:41:31Z","updated_at":"2016-03-11T00:29:11Z","closed_at":null,"body":"With SELinux Enforcing, with the new hostmount-anyuid scc for system:serviceaccount:logging:aggregated-logging-fluentd, fluentd is not able to read/write /var/log on the host."},"comment":{"url":"https://api.github.com/repos/openshift/origin-aggregated-logging/issues/comments/195116211","html_url":"https://github.com/openshift/origin-aggregated-logging/issues/89#issuecomment-195116211","issue_url":"https://api.github.com/repos/openshift/origin-aggregated-logging/issues/89","id":195116211,"user":{"login":"richm","id":23066,"avatar_url":"https://avatars.githubusercontent.com/u/23066?v=3","gravatar_id":"","url":"https://api.github.com/users/richm","html_url":"https://github.com/richm","followers_url":"https://api.github.com/users/richm/followers","following_url":"https://api.github.com/users/richm/following{/other_user}","gists_url":"https://api.github.com/users/richm/gists{/gist_id}","starred_url":"https://api.github.com/users/richm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/richm/subscriptions","organizations_url":"https://api.github.com/users/richm/orgs","repos_url":"https://api.github.com/users/richm/repos","events_url":"https://api.github.com/users/richm/events{/privacy}","received_events_url":"https://api.github.com/users/richm/received_events","type":"User","site_admin":false},"created_at":"2016-03-11T00:29:11Z","updated_at":"2016-03-11T00:29:11Z","body":"Tried doing this:\r\n\r\n> Under seLinuxOptions: you can specify a default, eg:\r\n>\r\n>      seLinuxOptions:\r\n>        level: \"s0:c123,c456\"\r\n>        user: xxxx  #selinux username\r\n>        role: yyyy  #selinux role, not openshift roles\r\n>        type: zzz\r\n\r\nI'm not sure what goes in xxxx and yyyy here.\r\nbut doing this:\r\n\r\n# oc edit scc hostmount-anyuid\r\n...\r\nrunAsUser:\r\n  type: RunAsAny\r\nseLinuxContext:\r\n  seLinuxOptions:\r\n    level: s0:c6,c1\r\n    type: spc_t\r\n  type: MustRunAs\r\nsupplementalGroups:\r\n  type: RunAsAny\r\n...\r\n\r\ndoesn't work - fluentd doesn't start - AVCs like this:\r\n\r\ntype=AVC msg=audit(1457655809.603:929): avc:  denied  { entrypoint } for  pid=8879 comm=\"exe\" path=\"/pod\" dev=\"dm-1\" ino=4718595 scontext=system_u:system_r:spc_t:s0:c1,c6 tcontext=system_u:object_r:svirt_sandbox_file_t:s0:c1,c6 tclass=file\r\n        Was caused by:\r\n                Missing type enforcement (TE) allow rule.\r\n\r\n                You can use audit2allow to generate a loadable module to allow this access. "}}