Howto: Proper SELinux context for systemd-units in /etc/systemd/system

edit

@heliosstyx , Thanks for that video link, that was quite a helpful talk.

@villykruse , I changed the SELinuxContext to the correct one, that took care of the errors related to logrotate, thanks. However, my service file is being denied the transition:

audit[7448]: AVC avc:  denied  { transition } for  pid=7448 comm="(ogrotate)" path="/usr/sbin/logrotate" dev="sda1" ino=15436 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:logrotate_t:s0 tclass=process permissive=1

The problem is that two transition statements in the policy I ended up with

module logrotate-systemd 1.0;

<snip>

#============= init_t ==============
allow init_t logrotate_exec_t:file { execute execute_no_trans open read };
allow init_t logrotate_exec_t:process { noatsecure transition };
allow init_t logrotate_t:process transition;

#============= logrotate_exec_t ==============
allow logrotate_exec_t self:file entrypoint;

violate process transisioning constraints

constrain process { transition noatsecure siginh rlimitinh dyntransition } (
    (r1 == r2 -Fail-)  or
    (t1 == can_change_process_role)  and (t2 == process_user_target -Fail-)  or
    (t1 == cron_source_domain -Fail-)  and (t2 == cron_job_domain -Fail-)  or
    (t1 == can_system_change -Fail-)  and (r2 == system_r -Fail-)  or (t1 == process_uncond_exempt -Fail-) );
Constraint DENIED

All condition except for the first one fail at the target (logrotate), the first one fails probably because I'm trying to transition from systemr to objectr, i.e. r1 != r2 . However, systemr is what systemd units are supposed to run under, and other, system, units/timers like mlocate-updatedb.(service|timer) also call executables with objectr yet don't fail.