rpms-fedora-extras/frr
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Resolves: #2311119 - Multiple AVCs for accessing lib_t in FRR-10.1

Browse Source 
Resolves: #2311120 - AVCs for using a netlink socket in FRR
This commit is contained in:
Michal Ruprich
2024-09-10 14:44:31 +02:00
parent fadec67736
commit 0d2ad1b406
3 changed files with 18 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
frr.fc
View File

@@ -6,6 +6,7 @@
/var/log/frr(/.*)? gen_context(system_u:object_r:frr_log_t,s0)
/var/tmp/frr(/.*)? gen_context(system_u:object_r:frr_tmp_t,s0)
/var/lib/frr(/.*)? gen_context(system_u:object_r:frr_var_lib_t,s0)
/run/lock/subsys/bfdd -- gen_context(system_u:object_r:frr_lock_t,s0)
/run/lock/subsys/bgpd -- gen_context(system_u:object_r:frr_lock_t,s0)

6
frr.spec
View File

@@ -9,7 +9,7 @@
Name: frr
Version: 10.1
Release: 3%{?dist}
Release: 4%{?dist}
Summary: Routing daemon
License: GPL-2.0-or-later AND ISC AND LGPL-2.0-or-later AND BSD-2-Clause AND BSD-3-Clause AND (GPL-2.0-or-later OR ISC) AND MIT
URL: http://www.frrouting.org
@@ -277,6 +277,10 @@ rm tests/lib/*grpc*
%endif
%changelog
* Tue Sep 10 2024 Michal Ruprich <mruprich@redhat.com> - 10.1-4
- Resolves: #2311119 - Multiple AVCs for accessing lib_t in FRR-10.1
- Resolves: #2311120 - AVCs for using a netlink socket in FRR
* Sun Aug 25 2024 Benjamin A. Beasley <code@musicinmybrain.net> - 10.1-3
- Rebuilt for abseil-cpp-20240722.0

12
frr.te
View File

@@ -27,12 +27,20 @@ systemd_unit_file(frr_unit_file_t)
type frr_var_run_t;
files_pid_file(frr_var_run_t)
type frr_var_lib_t;
files_type(frr_var_lib_t)
########################################
#
# frr local policy
#
allow frr_t self:capability { chown dac_override dac_read_search kill net_bind_service net_raw setgid setuid net_admin sys_admin };
allow frr_t self:netlink_route_socket rw_netlink_socket_perms;
allow frr_t self:netlink_generic_socket create;
allow frr_t self:netlink_generic_socket setopt;
allow frr_t self:netlink_generic_socket getopt;
allow frr_t self:netlink_generic_socket getattr;
allow frr_t self:netlink_generic_socket bind;
allow frr_t self:packet_socket create_socket_perms;
allow frr_t self:process { setcap setpgid };
allow frr_t self:rawip_socket create_socket_perms;
@@ -49,6 +57,10 @@ manage_files_pattern(frr_t, frr_log_t, frr_log_t)
manage_lnk_files_pattern(frr_t, frr_log_t, frr_log_t)
logging_log_filetrans(frr_t, frr_log_t, { dir file lnk_file })
manage_dirs_pattern(frr_t, frr_var_lib_t, frr_var_lib_t)
manage_files_pattern(frr_t, frr_var_lib_t, frr_var_lib_t)
files_var_lib_filetrans(frr_t, frr_var_lib_t, { dir file })
allow frr_t frr_tmp_t:file map;
manage_dirs_pattern(frr_t, frr_tmp_t, frr_tmp_t)
manage_files_pattern(frr_t, frr_tmp_t, frr_tmp_t)