Accepting request 1328441 from Base:System

OBS-URL: https://build.opensuse.org/request/show/1328441
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/rsyslog?expand=0&rev=184

rsyslog-service-prepare.in

@@ -20,6 +20,8 @@ for variable in ${!SYSLOGD_ADDITIONAL_SOCKET*}; do
 	echo "\$AddUnixListenSocket $value"
 done >> "${cfg_file}"
 
+restorecon -R "${run_dir}" 2> /dev/null
+
 #
 # make sure xconsole exists and is a pipe
 #

rsyslog-tmpfiles.conf

@@ -0,0 +1,11 @@
+f /var/log/messages 640 - - -
+f /var/log/mail 640 - - -
+f /var/log/mail.info 640 - - -
+f /var/log/mail.warn 640 - - -
+f /var/log/mail.err 640 - - -
+f /var/log/acpid 640 - - -
+f /var/log/firewall 640 - - -
+f /var/log/NetworkManager 640 - - -
+D /run/rsyslog 0755 - - -
+f /run/rsyslog/additional-log-sockets.conf 640 - - -
+D /var/spool/rsyslog 0755 - - -

rsyslog.changes

@@ -1,3 +1,13 @@
+-------------------------------------------------------------------
+Mon Jan 19 15:10:35 UTC 2026 - Thomas Blume <Thomas.Blume@suse.com>
+
+- switch to tmpfiles based file creation in specfile (jsc#PED-14786)
+
+-------------------------------------------------------------------
+Fri Nov 21 12:21:20 UTC 2025 - Filippo Bonazzi <filippo.bonazzi@suse.com>
+
+- Fix SELinux context of rsyslog run directory (bsc#1253261)
+
 -------------------------------------------------------------------
 Wed May 14 05:48:11 UTC 2025 - Thomas Blume <Thomas.Blume@suse.com>
 

rsyslog.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package rsyslog
 #
-# Copyright (c) 2025 SUSE LLC
+# Copyright (c) 2026 SUSE LLC and contributors
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -219,6 +219,7 @@ Source16:       journald-rsyslog.conf
 Source17:       acpid.frule
 Source18:       firewall.frule
 Source19:       NetworkManager.frule
+Source20:       rsyslog-tmpfiles.conf
 
 # this is a dirty hack since % dir does only work for the specified directory and nothing above
 # but I want to be able to switch this to /etc/apparmor.d once the profiles received more testing
@@ -774,7 +775,6 @@ ln -svf service %buildroot/%{_sbindir}/rc%{name}
 #
 install -d -m0755 %{buildroot}%{_sysconfdir}/rsyslog.d
 install -d -m0755 %{buildroot}%{_localstatedir}/run/rsyslog
-install -d -m0755 %{buildroot}%{_localstatedir}/spool/rsyslog
 for file in rsyslog.conf rsyslog.d.remote.conf ; do
 	sed \
 %ifarch s390 s390x
@@ -816,9 +816,6 @@ install -m644 %{SOURCE3} %{buildroot}%{_unitdir}/
 install -d -m0755 %{buildroot}%{_prefix}/lib/systemd/journald.conf.d
 install -m644 %{SOURCE16} %{buildroot}%{_prefix}/lib/systemd/journald.conf.d/30-rsyslog.conf
 # create ghosts
-install -d -m0755 %{buildroot}%{rsyslog_rundir}
-touch %{buildroot}%{rsyslog_sockets_cfg}
-chmod 644 %{buildroot}%{rsyslog_sockets_cfg}
 mkdir -p %{buildroot}%{APPARMOR_PROFILE_PATH}/rsyslog.d/
 install -m0640 %{SOURCE6} %{buildroot}%{APPARMOR_PROFILE_PATH}/
 install -m0600 %{SOURCE17} %{buildroot}%{_sysconfdir}/rsyslog.d/
@@ -846,6 +843,10 @@ install -m0600 %{SOURCE19} %{buildroot}%{_sysconfdir}/rsyslog.d/
 %endif \
 %{nil}
 
+#switch to tmpfiles config
+mkdir -p %{buildroot}%{_tmpfilesdir}
+install -m 644 %{SOURCE20} %{buildroot}%{_tmpfilesdir}/rsyslog.conf
+
 %pre
 %{service_add_pre rsyslog.service}
 
@@ -873,29 +874,6 @@ if grep -qs '^local[0246],' etc/rsyslog.conf ; then
    sed -i -e 's/^local\([0246]\),/local\1.*;/g' etc/rsyslog.conf
 fi
 #
-# create dirs, touch log default files
-#
-if [ "$1" = "1" ] ; then  # first install
-mkdir -p var/log
-touch var/log/messages;  chmod 640 var/log/messages
-touch var/log/mail;      chmod 640 var/log/mail
-touch var/log/mail.info; chmod 640 var/log/mail.info
-touch var/log/mail.warn; chmod 640 var/log/mail.warn
-touch var/log/mail.err;  chmod 640 var/log/mail.err
-#
-# touch the additional log files we are using
-#
-touch var/log/acpid;            chmod 640 var/log/acpid
-touch var/log/firewall;         chmod 640 var/log/firewall
-touch var/log/NetworkManager;   chmod 640 var/log/NetworkManager
-#
-# touch the additional log sockets config file
-#
-mkdir -p -m750 ".%{rsyslog_rundir}"
-touch ".%{rsyslog_sockets_cfg}"
-chmod 640 ".%{rsyslog_sockets_cfg}"
-fi # first install
-#
 # Enable the rsyslogservice to be started by systemd
 #
 # This macro enables based on a systemctl preset config file only
@@ -1080,15 +1058,13 @@ fi # first install
 %doc %{rsyslogdocdir}/ChangeLog
 %doc %{rsyslogdocdir}/README
 %doc %{rsyslogdocdir}/AUTHORS
-%dir %{_localstatedir}/spool/rsyslog
 %{_fillupdir}/sysconfig.syslog-rsyslog
-%attr(0755,root,root) %dir %ghost %{rsyslog_rundir}
-%attr(0644,root,root) %ghost %{rsyslog_sockets_cfg}
 %{_sbindir}/rsyslog-service-prepare
 %{_unitdir}/rsyslog.service
 %{_sbindir}/rc%{name}
 %{APPARMOR_PROFILE_PATH_DIR_COMMANDS}
 %{APPARMOR_PROFILE_PATH}/usr.sbin.rsyslogd
+%{_tmpfilesdir}/rsyslog.conf
 
 %files doc
 %defattr(-,root,root)