3 Commits

Author	SHA1	Message	Date
Vit Mojzis	9c91b908e1	SELinux: rename ifconfig_run interfaces to be more specific ... The change has no functional impact on the policy. It is just to keep it in sync with the interfaces shipped in selinux-policy-* packages. Signed-off-by: Vit Mojzis <vmojzis@redhat.com>	2024-01-25 12:51:35 +00:00
Michal Ruprich	de8d85febb	frr-8.5.1-4 ... Selinux policy changes: - Allow watch,read on /var/run/netns directory and its content - Add sys_admin capability It seems like sys_admin is needed because frr is using setns function to change the actual namespace. Full log here: type=PROCTITLE msg=audit(06/29/2023 03:42:07.692:559) : proctitle=/usr/libexec/frr/zebra -d -F traditional -A 127.0.0.1 -s 90000000 -n type=SYSCALL msg=audit(06/29/2023 03:42:07.692:559) : arch=x86_64 syscall=setns success=no exit=EPERM(Operation not permitted) a0=0x11 a1=CLONE_NEWNET a2=0x0 a3=0x0 items=0 ppid=3692 pid=3701 auid=unset uid=frr gid=frr euid=frr suid=frr fsuid=frr egid=frr sgid=frr fsgid=frr tty=(none) ses=unset comm=zebra exe=/usr/libexec/frr/zebra subj=system_u:system_r:frr_t:s0 key=(null) type=AVC msg=audit(06/29/2023 03:42:07.692:559) : avc: denied { sys_admin } for pid=3701 comm=zebra capability=sys_admin scontext=system_u:system_r:frr_t:s0 tcontext=system_u:system_r:frr_t:s0 tclass=capability permissive=0 Resolves: #2216073 - SELinux is preventing FRR-Zebra to access to network namespaces	2023-06-29 15:54:02 +02:00
Michal Ruprich	9408b0b09e	Packaging SELinux policy for FRR	2022-07-28 13:35:19 +02:00