Bug 1941765
| Summary: | AVCs while running frr tests on RHEL 8.4.0 Beta-1.2 | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Daniel Rusek <drusek> |
| Component: | frr | Assignee: | Michal Ruprich <mruprich> |
| Status: | CLOSED ERRATA | QA Contact: | František Hrdina <fhrdina> |
| Severity: | unspecified | Docs Contact: | Šárka Jana <sjanderk> |
| Priority: | unspecified | ||
| Version: | 8.4 | CC: | brian, fhrdina, lvrabec, mmalik, plautrba, psklenar, sjanderk, ssekidde, svenvd |
| Target Milestone: | rc | Keywords: | AutoVerified, Triaged |
| Target Release: | --- | Flags: | pm-rhel:
mirror+
|
| Hardware: | Unspecified | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | frr-7.5.1-3.el8 | Doc Type: | Bug Fix |
| Doc Text: |
.The `frr` binary files and scripts have a new location
Previously, the `frr` package for managing dynamic routing stack contained its binary files and scripts in the `/usr/lib/frr` directory, which caused certain issues when applying the new targeted SELinux policy. Consequently, SELinux logged denial messages in access vector cache (AVC) and prevented `frr` from starting properly.
With this update, `/usr/libexec/frr` is the new location of the `frr` binary files and scripts. As a result, SELinux applies rules for binaries and scripts in `/usr/libexec/frr` and for other `frr` libraries in `/usr/lib64/frr` separately, and no longer produces denial messages.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-11-08 09:39:31 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1903942 | ||
|
Comment 1
Petr Sklenar
2021-03-23 08:00:20 UTC
Confining the frr service in its own selinux policy module is being worked on in bz#1714984, we expect the fix be delivered in RHEL 8.5. The SELinux denials say /usr/lib/frr/watchfrr process was running under init_t and did something unexpected. Is watchfrr a service which should be running for a long time, or is it a one-time script that finishes quickly? (In reply to Milos Malik from comment #3) > The SELinux denials say /usr/lib/frr/watchfrr process was running under > init_t and did something unexpected. Is watchfrr a service which should be > running for a long time, or is it a one-time script that finishes quickly? Hi, according to the user manual: "WATCHFRR is a daemon that handles failed daemon processes and intelligently restarts them as needed." http://docs.frrouting.org/en/latest/watchfrr.html Any update on this? *** Bug 2088030 has been marked as a duplicate of this bug. *** Switching the component to frr based on preliminary agreement with the team. *** Bug 2091615 has been marked as a duplicate of this bug. *** *** Bug 2043120 has been marked as a duplicate of this bug. *** Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (frr bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2022:7560 |