From a6a714eb342e9b09bb3b154cd21c81b29666b5a8 Mon Sep 17 00:00:00 2001 From: Michal Ruprich Date: Fri, 6 Feb 2026 12:08:52 +0100 Subject: [PATCH] RHEL-147189 - AVC failures when running frr10 --- frr.fc | 1 + frr.te | 18 ++++++++++++++++++ frr10.spec | 5 ++++- 3 files changed, 23 insertions(+), 1 deletion(-) diff --git a/frr.fc b/frr.fc index a6eac2c..f5c0bc9 100644 --- a/frr.fc +++ b/frr.fc @@ -6,6 +6,7 @@ /var/log/frr(/.*)? gen_context(system_u:object_r:frr_log_t,s0) /var/tmp/frr(/.*)? gen_context(system_u:object_r:frr_tmp_t,s0) +/var/lib/frr(/.*)? gen_context(system_u:object_r:frr_var_lib_t,s0) /var/lock/subsys/bfdd -- gen_context(system_u:object_r:frr_lock_t,s0) /var/lock/subsys/bgpd -- gen_context(system_u:object_r:frr_lock_t,s0) diff --git a/frr.te b/frr.te index d9d1169..32c339c 100644 --- a/frr.te +++ b/frr.te @@ -27,12 +27,20 @@ systemd_unit_file(frr_unit_file_t) type frr_var_run_t; files_pid_file(frr_var_run_t) +type frr_var_lib_t; +files_type(frr_var_lib_t) + ######################################## # # frr local policy # allow frr_t self:capability { chown dac_override dac_read_search kill net_bind_service net_raw setgid setuid net_admin sys_admin }; allow frr_t self:netlink_route_socket rw_netlink_socket_perms; +allow frr_t self:netlink_generic_socket create; +allow frr_t self:netlink_generic_socket setopt; +allow frr_t self:netlink_generic_socket getopt; +allow frr_t self:netlink_generic_socket getattr; +allow frr_t self:netlink_generic_socket bind; allow frr_t self:packet_socket create_socket_perms; allow frr_t self:process { setcap setpgid }; allow frr_t self:rawip_socket create_socket_perms; @@ -49,6 +57,10 @@ manage_files_pattern(frr_t, frr_log_t, frr_log_t) manage_lnk_files_pattern(frr_t, frr_log_t, frr_log_t) logging_log_filetrans(frr_t, frr_log_t, { dir file lnk_file }) +manage_dirs_pattern(frr_t, frr_var_lib_t, frr_var_lib_t) +manage_files_pattern(frr_t, frr_var_lib_t, frr_var_lib_t) +files_var_lib_filetrans(frr_t, frr_var_lib_t, { dir file }) + allow frr_t frr_tmp_t:file map; manage_dirs_pattern(frr_t, frr_tmp_t, frr_tmp_t) manage_files_pattern(frr_t, frr_tmp_t, frr_tmp_t) @@ -70,6 +82,7 @@ can_exec(frr_t, frr_exec_t) kernel_read_network_state(frr_t) kernel_rw_net_sysctls(frr_t) kernel_read_system_state(frr_t) +kernel_request_load_module(frr_t) auth_use_nsswitch(frr_t) @@ -78,8 +91,11 @@ corecmd_exec_bin(frr_t) corenet_tcp_bind_appswitch_emp_port(frr_t) corenet_udp_bind_bfd_control_port(frr_t) corenet_udp_bind_bfd_echo_port(frr_t) +corenet_udp_bind_bfd_multi_port(frr_t) corenet_tcp_bind_bgp_port(frr_t) corenet_tcp_connect_bgp_port(frr_t) +corenet_tcp_bind_cmadmin_port(frr_t) +corenet_udp_bind_cmadmin_port(frr_t) corenet_udp_bind_all_unreserved_ports(frr_t); corenet_tcp_bind_generic_port(frr_t) corenet_tcp_bind_firepower_port(frr_t) @@ -89,6 +105,8 @@ corenet_tcp_bind_qpasa_agent_port(frr_t) corenet_tcp_bind_smntubootstrap_port(frr_t) corenet_tcp_bind_versa_tek_port(frr_t) corenet_tcp_bind_zebra_port(frr_t) +# general reserved port for pimd +corenet_tcp_bind_reserved_port(frr_t) domain_use_interactive_fds(frr_t) diff --git a/frr10.spec b/frr10.spec index 736e3d7..e65d605 100644 --- a/frr10.spec +++ b/frr10.spec @@ -8,7 +8,7 @@ Name: frr10 Version: 10.4.1 -Release: 2%{?checkout}%{?dist} +Release: 3%{?checkout}%{?dist} Summary: Routing daemon License: GPLv2+ URL: http://www.frrouting.org @@ -282,6 +282,9 @@ make check PYTHON=%{__python3} %endif %changelog +* Fri Feb 06 2026 Michal Ruprich - 10.4.1-3 +- Resolves: RHEL-147189 - AVC failures when running frr10 + * Mon Dec 01 2025 Michal Ruprich - 10.4.1-2 - Enabling gating and testing, adding rpminspect.yaml