rpms/frr10
7
0
Fork 0
Code Issues Pull Requests Releases Activity

RHEL-147189 - AVC failures when running frr10

Browse Source
This commit is contained in:
Michal Ruprich 2026-02-06 12:08:52 +01:00
parent 1e80d7cb27
commit a6a714eb34
3 changed files with 23 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
frr.fc
View File

@ -6,6 +6,7 @@
/var/log/frr(/.*)? gen_context(system_u:object_r:frr_log_t,s0)
/var/tmp/frr(/.*)? gen_context(system_u:object_r:frr_tmp_t,s0)
/var/lib/frr(/.*)? gen_context(system_u:object_r:frr_var_lib_t,s0)
/var/lock/subsys/bfdd -- gen_context(system_u:object_r:frr_lock_t,s0)
/var/lock/subsys/bgpd -- gen_context(system_u:object_r:frr_lock_t,s0)

18
frr.te
View File

@ -27,12 +27,20 @@ systemd_unit_file(frr_unit_file_t)
type frr_var_run_t;
files_pid_file(frr_var_run_t)
type frr_var_lib_t;
files_type(frr_var_lib_t)
########################################
#
# frr local policy
#
allow frr_t self:capability { chown dac_override dac_read_search kill net_bind_service net_raw setgid setuid net_admin sys_admin };
allow frr_t self:netlink_route_socket rw_netlink_socket_perms;
allow frr_t self:netlink_generic_socket create;
allow frr_t self:netlink_generic_socket setopt;
allow frr_t self:netlink_generic_socket getopt;
allow frr_t self:netlink_generic_socket getattr;
allow frr_t self:netlink_generic_socket bind;
allow frr_t self:packet_socket create_socket_perms;
allow frr_t self:process { setcap setpgid };
allow frr_t self:rawip_socket create_socket_perms;
@ -49,6 +57,10 @@ manage_files_pattern(frr_t, frr_log_t, frr_log_t)
manage_lnk_files_pattern(frr_t, frr_log_t, frr_log_t)
logging_log_filetrans(frr_t, frr_log_t, { dir file lnk_file })
manage_dirs_pattern(frr_t, frr_var_lib_t, frr_var_lib_t)
manage_files_pattern(frr_t, frr_var_lib_t, frr_var_lib_t)
files_var_lib_filetrans(frr_t, frr_var_lib_t, { dir file })
allow frr_t frr_tmp_t:file map;
manage_dirs_pattern(frr_t, frr_tmp_t, frr_tmp_t)
manage_files_pattern(frr_t, frr_tmp_t, frr_tmp_t)
@ -70,6 +82,7 @@ can_exec(frr_t, frr_exec_t)
kernel_read_network_state(frr_t)
kernel_rw_net_sysctls(frr_t)
kernel_read_system_state(frr_t)
kernel_request_load_module(frr_t)
auth_use_nsswitch(frr_t)
@ -78,8 +91,11 @@ corecmd_exec_bin(frr_t)
corenet_tcp_bind_appswitch_emp_port(frr_t)
corenet_udp_bind_bfd_control_port(frr_t)
corenet_udp_bind_bfd_echo_port(frr_t)
corenet_udp_bind_bfd_multi_port(frr_t)
corenet_tcp_bind_bgp_port(frr_t)
corenet_tcp_connect_bgp_port(frr_t)
corenet_tcp_bind_cmadmin_port(frr_t)
corenet_udp_bind_cmadmin_port(frr_t)
corenet_udp_bind_all_unreserved_ports(frr_t);
corenet_tcp_bind_generic_port(frr_t)
corenet_tcp_bind_firepower_port(frr_t)
@ -89,6 +105,8 @@ corenet_tcp_bind_qpasa_agent_port(frr_t)
corenet_tcp_bind_smntubootstrap_port(frr_t)
corenet_tcp_bind_versa_tek_port(frr_t)
corenet_tcp_bind_zebra_port(frr_t)
# general reserved port for pimd
corenet_tcp_bind_reserved_port(frr_t)
domain_use_interactive_fds(frr_t)

5
frr10.spec
View File

@ -8,7 +8,7 @@
Name: frr10
Version: 10.4.1
Release: 2%{?checkout}%{?dist}
Release: 3%{?checkout}%{?dist}
Summary: Routing daemon
License: GPLv2+
URL: http://www.frrouting.org
@ -282,6 +282,9 @@ make check PYTHON=%{__python3}
%endif
%changelog
* Fri Feb 06 2026 Michal Ruprich <mruprich@redhat.com> - 10.4.1-3
- Resolves: RHEL-147189 - AVC failures when running frr10
* Mon Dec 01 2025 Michal Ruprich <mruprich@redhat.com> - 10.4.1-2
- Enabling gating and testing, adding rpminspect.yaml