[CentOS] EL8: SElinux / dac_override / tmpwatch

Sat Aug 29 21:00:05 UTC 2020
Leon Fauster <leonfauster at googlemail.com>

Am 29.08.20 um 01:56 schrieb Jonathan Billings:
> On Aug 28, 2020, at 17:53, Leon Fauster via CentOS <centos at centos.org> wrote:
>> Is cron running in EL8 with stripped CAPs of? Does some one have an
>> idea to address this?
> In general, we no longer use tmpwatch at all.  In CentOS 7 and 8, use systemd-tmpfiles. Here is a blog post that describes it pretty well:
> https://developers.redhat.com/blog/2016/09/20/managing-temporary-files-with-systemd-tmpfiles-on-rhel7/

Thanks, it seems that this migration will take more time :-).

Okay, systemd-tmpfiles is a reasonable solution for one scenario
here but some questions still persists for a second one:

As you see - the next clean up will be in 23h

# systemctl status systemd-tmpfiles-clean.timer

● systemd-tmpfiles-clean.timer - Daily Cleanup of Temporary Directories
    Loaded: loaded 
(/usr/lib/systemd/system/systemd-tmpfiles-clean.timer; static; vendor 
preset: disabled)
    Active: active (waiting) since Sat 2020-08-29 21:53:11 CEST; 53min ago
   Trigger: Sun 2020-08-30 22:07:52 CEST; 23h left
      Docs: man:tmpfiles.d(5)

# systemctl list-timers

NEXT                          LEFT          LAST 
  PASSED     UNIT                         ACTIVATES
Sun 2020-08-30 22:07:52 CEST  23h left      Sat 2020-08-29 22:07:52 CEST 
  39min ago  systemd-tmpfiles-clean.timer systemd-tmpfiles-clean.service

What triggers cleanups that must be done every hour for example?

# cat /usr/lib/tmpfiles.d/app-tmp.conf
e /srv/app/*/tmp - - - 1h

# man tmpfiles.d

is mentioning (m)minutes, (s)econds and even us (microseconds).

Do I need to override the systemd-tmpfiles-clean.timer unit?

# systemctl cat systemd-tmpfiles-clean.timer

It seems that this is more prepared for daily clean ups?