Create SELinux fcontext equivalence for logs

The syslog daemon cannot perform operations on logs within
`/openstack/log` because the files in the directory are labeled as
`default_t`. The syslog daemon does not have a policy that allows
it to touch files with that label.

This patch adds a fcontext equivalence that tells SELinux to consider
`/openstack/log` to be the same as `/var/log`. Proper contexts are
applied to `/openstack/log` as soon as the equivalence is added.

Closes-Bug: 1660429
Change-Id: I7174b5e44f2f84b837aa23507bcf5702d023785e

tasks/lxc_post_install.yml

@@ -52,3 +52,8 @@
 
 # Ensure apparmor reindex runs before other things that may fail
 - meta: flush_handlers
+
+- include: lxc_selinux.yml
+  when:
+    - ansible_selinux.status is defined
+    - ansible_selinux.status == "enabled"

tasks/lxc_selinux.yml

@@ -0,0 +1,41 @@
+---
+# Copyright 2017, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+- name: Check if /openstack/log exists
+  stat:
+    path: /openstack/log
+  register: openstack_log_dir
+
+- name: Check for SELinux equivalence for /openstack/log
+  shell: "semanage fcontext -l /openstack/log | grep ^/openstack/log || true"
+  register: fcontext_check
+  tags:
+    - skip_ansible_lint
+
+- name: Create SELinux fcontext equivalence for OpenStack container logs
+  command: semanage fcontext --add --equal /var/log /openstack/log
+  failed_when: selinux_equivalence.rc not in [0,1]
+  changed_when: selinux_equivalence.rc == 0
+  register: selinux_equivalence
+  when:
+    - openstack_log_dir.stat.exists
+    - '"/openstack/log" not in fcontext_check.stdout'
+
+- name: Apply updated SELinux contexts on /openstack/log
+  command: restorecon -R /openstack/log
+  when:
+    - openstack_log_dir.stat.exists
+    - '"/openstack/log" not in fcontext_check.stdout'
+    - selinux_equivalence | changed

vars/redhat-7.yml

@@ -33,6 +33,7 @@ lxc_hosts_distro_packages:
   - libcap-devel
   - libselinux
   - libselinux-devel
+  - policycoreutils-python
   - python-devel
   - python34-libs
   - python34-devel