Last Modified: Oct 22, 2026
Affected Product(s):
BIG-IP TMOS
Known Affected Versions:
21.1.0.3
Opened: Oct 08, 2026 Severity: 3-Major
While executing the tpedrmon log rotation command: /usr/sbin/logrotate -s /var/lib/logrotate-tpedrmon.status /etc/logrotate.d/tpedrmon The command immediately fails with Permission denied (even as root): [root@localhost:ModuleNotLicensed::Active:Standalone] config # /usr/sbin/logrotate -s /var/lib/logrotate-tpedrmon.status /etc/logrotate.d/tpedrmon error: stat of /shared/.tp_edr_mon_logs/tp_edr_mon.log failed: Permission denied Simultaneously, an SELinux AVC denial is logged in /var/log/audit/audit.log: type=SYSCALL msg=audit(1791476642.660:6551): arch=c000003e syscall=6 success=no exit=-13 comm="logrotate" exe="/usr/sbin/logrotate" subj=unconfined_u:unconfined_r:logrotate_t:s0-s0:c0.c1023 type=AVC msg=audit(1791476642.660:6551): avc: denied { getattr } for pid=24814 comm="logrotate" path="/shared/.tp_edr_mon_logs/tp_edr_mon.log" dev="dm-1" ino=524297 scontext=unconfined_u:unconfined_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=file
The tpedrmon log rotation job generates SELinux AVC denials.
The denials are generated whenever the periodic tpedrmon log rotation job runs. The logrotate process (logrotate_t) is denied { getattr } access to /shared/.tp_edr_mon_logs/tp_edr_mon.log because the log file has the generic default_t:s0 SELinux context instead of a valid log context.
Modify default_t context to var_log_t in selinux config files: /shared/\.tp_edr_mon_logs(/.*)? system_u:object_r:var_log_t:s0 Above change won't survive upgrade.
None