Compare commits

..

22 Commits

Author SHA1 Message Date
Zoran Peričić
371b61b672 v.ims.1 - Bump version 2024-05-19 21:54:42 +02:00
400eab4931 nhrp: configure strongswan vici path 2024-05-19 21:54:41 +02:00
Michal Ruprich
3489012fd4 Resolves: #2273524 - frr fails to start: SELinux is preventing watchfrr from create access on the sock_file 2024-04-10 10:46:33 +02:00
Benjamin A. Beasley
14d3b39746 Rebuilt for abseil-cpp-20240116.0 2024-02-04 11:26:57 -05:00
Michal Ruprich
f10270279b New version 9.1 2024-01-25 14:43:24 +01:00
Vit Mojzis
9c91b908e1 SELinux: rename ifconfig_run interfaces to be more specific
The change has no functional impact on the policy. It is just to keep it
in sync with the interfaces shipped in selinux-policy-* packages.

Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
2024-01-25 12:51:35 +00:00
Fedora Release Engineering
2228c29472 Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild 2024-01-24 12:05:55 +00:00
Fedora Release Engineering
9bf8cfe430 Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild 2024-01-19 19:51:00 +00:00
Michal Ruprich
30f4eb8e8e New version 9.0.1 2023-10-16 09:44:02 +02:00
Michal Ruprich
ca06a43267 Adding a couple of SELinux rules, includes fix for rhbz#2149299 2023-09-01 13:15:04 +02:00
Benjamin A. Beasley
4405129034 Rebuilt for abseil-cpp 20230802.0 2023-08-30 07:50:46 -04:00
Zdenek Pytela
a302f6117d Update SELinux rule to allow frr daemons create and use packet socket
The commit addresses the following AVC denial:
type=PROCTITLE msg=audit(07/27/2023 11:26:31.692:622) : proctitle=/usr/libexec/frr/bfdd -d -F traditional -A 127.0.0.1
type=SOCKADDR msg=audit(07/27/2023 11:26:31.692:622) : saddr={ saddr_fam=packet (unsupported) }
type=SYSCALL msg=audit(07/27/2023 11:26:31.692:622) : arch=x86_64 syscall=bind success=no exit=EACCES(Permission denied) a0=0xf a1=0x7ffeb8c5a000 a2=0x14 a3=0x7ffeb8c59ff0 items=0 ppid=7818 pid=7903 auid=unset uid=frr gid=frr euid=frr suid=frr fsuid=frr egid=frr sgid=frr fsgid=frr tty=(none) ses=unset comm=bfdd exe=/usr/libexec/frr/bfdd subj=system_u:system_r:frr_t:s0 key=(null)
type=AVC msg=audit(07/27/2023 11:26:31.692:622) : avc:  denied  { bind } for  pid=7903 comm=bfdd scontext=system_u:system_r:frr_t:s0 tcontext=system_u:system_r:frr_t:s0 tclass=packet_socket permissive=0

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2216912
2023-08-01 09:40:29 +02:00
Fedora Release Engineering
73b57e75c1 Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
2023-07-19 20:19:19 +00:00
Michal Ruprich
b6998f1514 New version 8.5.2 2023-06-30 15:51:23 +02:00
Michal Ruprich
de8d85febb frr-8.5.1-4
Selinux policy changes:
- Allow watch,read on /var/run/netns directory and its content
- Add sys_admin capability

It seems like sys_admin is needed because frr is using setns function to change the actual namespace. Full log here:
type=PROCTITLE msg=audit(06/29/2023 03:42:07.692:559) : proctitle=/usr/libexec/frr/zebra -d -F traditional -A 127.0.0.1 -s 90000000 -n
type=SYSCALL msg=audit(06/29/2023 03:42:07.692:559) : arch=x86_64 syscall=setns success=no exit=EPERM(Operation not permitted) a0=0x11 a1=CLONE_NEWNET a2=0x0 a3=0x0 items=0 ppid=3692 pid=3701 auid=unset uid=frr gid=frr euid=frr suid=frr fsuid=frr egid=frr sgid=frr fsgid=frr tty=(none) ses=unset comm=zebra exe=/usr/libexec/frr/zebra subj=system_u:system_r:frr_t:s0 key=(null)
type=AVC msg=audit(06/29/2023 03:42:07.692:559) : avc: denied { sys_admin } for pid=3701 comm=zebra capability=sys_admin scontext=system_u:system_r:frr_t:s0 tcontext=system_u:system_r:frr_t:s0 tclass=capability permissive=0

Resolves: #2216073 - SELinux is preventing FRR-Zebra to access to network namespaces
2023-06-29 15:54:02 +02:00
Yaakov Selkowitz
7f0775ec07 Disable grpc in RHEL builds
This is based on c9s:

bb27be6ef6
2023-06-05 19:29:36 -04:00
Petr Písař
eee04cae3d Rebuild against rpm-4.19 (https://fedoraproject.org/wiki/Changes/RPM-4.19) 2023-05-19 15:11:46 +02:00
Michal Ruprich
58b91e7bdb New version 8.5.1 2023-04-26 13:21:40 +02:00
Michal Ruprich
a5fc21e539 New version 8.5 2023-04-12 14:07:11 +02:00
Michal Ruprich
12b88485f2 Rebuilding for new abseil-cpp version 2023-03-23 13:33:53 +01:00
Michal Ruprich
f062556435 SPDX migration 2023-03-22 13:05:16 +01:00
Benjamin A. Beasley
28e257ed71 Build as C++17, required by abseil-cpp 20230125 2023-03-08 18:06:40 -05:00
10 changed files with 163 additions and 42 deletions

4
.gitignore vendored
View File

@@ -15,3 +15,7 @@
/frr-8.4.1.tar.gz
/frr-8.4.2.tar.gz
/frr-8.5.tar.gz
/frr-8.5.1.tar.gz
/frr-8.5.2.tar.gz
/frr-9.0.1.tar.gz
/frr-9.1.tar.gz

View File

@@ -16,9 +16,9 @@ index 5be3264..33abc1d 100644
snapcraft/helpers \
snapcraft/snap \
- babeld/Makefile \
mgmtd/Makefile \
bgpd/Makefile \
bgpd/rfp-example/librfp/Makefile \
bgpd/rfp-example/rfptest/Makefile \
@@ -193,7 +190,6 @@ EXTRA_DIST += \
fpm/Makefile \
grpc/Makefile \

View File

@@ -8,8 +8,8 @@ index 0b7af18..0533e24 100644
lib/log_vty.c \
- lib/md5.c \
lib/memory.c \
lib/mlag.c \
lib/module.c \
lib/mgmt_be_client.c \
lib/mgmt_fe_client.c \
@@ -64,7 +64,6 @@ lib_libfrr_la_SOURCES = \
lib/routemap_northbound.c \
lib/sbuf.c \
@@ -24,8 +24,8 @@ index 0b7af18..0533e24 100644
lib/log_vty.h \
- lib/md5.h \
lib/memory.h \
lib/module.h \
lib/monotime.h \
lib/mgmt.pb-c.h \
lib/mgmt_be_client.h \
@@ -191,7 +190,6 @@ pkginclude_HEADERS += \
lib/route_opaque.h \
lib/sbuf.h \

View File

@@ -3,8 +3,8 @@ index 631465f..e084ff3 100644
--- a/ospfd/ospf_vty.c
+++ b/ospfd/ospf_vty.c
@@ -1136,6 +1136,11 @@ DEFUN (ospf_area_vlink,
if (argv_find(argv, argc, "message-digest", &idx)) {
vl_config.keychain = argv[idx+1]->arg;
} else if (argv_find(argv, argc, "message-digest", &idx)) {
/* authentication message-digest */
+ if(FIPS_mode())
+ {
@@ -41,7 +41,7 @@ index 631465f..e084ff3 100644
+ }
SET_IF_PARAM(params, auth_type);
params->auth_type = OSPF_AUTH_CRYPTOGRAPHIC;
return CMD_SUCCESS;
UNSET_IF_PARAM(params, keychain_name);
@@ -6971,6 +6990,11 @@ DEFUN (ip_ospf_message_digest_key,
"The OSPF password (key)\n"
"Address of interface\n")

View File

@@ -3,8 +3,8 @@ index 7b5eaa4..5c82f69 100644
--- a/tests/lib/subdir.am
+++ b/tests/lib/subdir.am
@@ -18,18 +18,6 @@ tests_lib_test_frrscript_SOURCES = tests/lib/test_frrscript.c
EXTRA_DIST += tests/lib/test_frrscript.py
test -e tests/lib/script1.lua || \
$(INSTALL_SCRIPT) $< tests/lib/script1.lua
-##############################################################################
-GRPC_TESTS_LDADD = staticd/libstatic.a grpc/libfrrgrpc_pb.la -lgrpc++ -lprotobuf $(ALL_TESTS_LDADD) $(LIBYANG_LIBS) -lm

34
frr.fc
View File

@@ -7,23 +7,23 @@
/var/log/frr(/.*)? gen_context(system_u:object_r:frr_log_t,s0)
/var/tmp/frr(/.*)? gen_context(system_u:object_r:frr_tmp_t,s0)
/var/lock/subsys/bfdd -- gen_context(system_u:object_r:frr_lock_t,s0)
/var/lock/subsys/bgpd -- gen_context(system_u:object_r:frr_lock_t,s0)
/var/lock/subsys/eigrpd -- gen_context(system_u:object_r:frr_lock_t,s0)
/var/lock/subsys/fabricd -- gen_context(system_u:object_r:frr_lock_t,s0)
/var/lock/subsys/isisd -- gen_context(system_u:object_r:frr_lock_t,s0)
/var/lock/subsys/nhrpd -- gen_context(system_u:object_r:frr_lock_t,s0)
/var/lock/subsys/ospf6d -- gen_context(system_u:object_r:frr_lock_t,s0)
/var/lock/subsys/ospfd -- gen_context(system_u:object_r:frr_lock_t,s0)
/var/lock/subsys/pbrd -- gen_context(system_u:object_r:frr_lock_t,s0)
/var/lock/subsys/pimd -- gen_context(system_u:object_r:frr_lock_t,s0)
/var/lock/subsys/ripd -- gen_context(system_u:object_r:frr_lock_t,s0)
/var/lock/subsys/ripngd -- gen_context(system_u:object_r:frr_lock_t,s0)
/var/lock/subsys/staticd -- gen_context(system_u:object_r:frr_lock_t,s0)
/var/lock/subsys/zebra -- gen_context(system_u:object_r:frr_lock_t,s0)
/var/lock/subsys/vrrpd -- gen_context(system_u:object_r:frr_lock_t,s0)
/var/lock/subsys/pathd -- gen_context(system_u:object_r:frr_lock_t,s0)
/run/lock/subsys/bfdd -- gen_context(system_u:object_r:frr_lock_t,s0)
/run/lock/subsys/bgpd -- gen_context(system_u:object_r:frr_lock_t,s0)
/run/lock/subsys/eigrpd -- gen_context(system_u:object_r:frr_lock_t,s0)
/run/lock/subsys/fabricd -- gen_context(system_u:object_r:frr_lock_t,s0)
/run/lock/subsys/isisd -- gen_context(system_u:object_r:frr_lock_t,s0)
/run/lock/subsys/nhrpd -- gen_context(system_u:object_r:frr_lock_t,s0)
/run/lock/subsys/ospf6d -- gen_context(system_u:object_r:frr_lock_t,s0)
/run/lock/subsys/ospfd -- gen_context(system_u:object_r:frr_lock_t,s0)
/run/lock/subsys/pbrd -- gen_context(system_u:object_r:frr_lock_t,s0)
/run/lock/subsys/pimd -- gen_context(system_u:object_r:frr_lock_t,s0)
/run/lock/subsys/ripd -- gen_context(system_u:object_r:frr_lock_t,s0)
/run/lock/subsys/ripngd -- gen_context(system_u:object_r:frr_lock_t,s0)
/run/lock/subsys/staticd -- gen_context(system_u:object_r:frr_lock_t,s0)
/run/lock/subsys/zebra -- gen_context(system_u:object_r:frr_lock_t,s0)
/run/lock/subsys/vrrpd -- gen_context(system_u:object_r:frr_lock_t,s0)
/run/lock/subsys/pathd -- gen_context(system_u:object_r:frr_lock_t,s0)
/var/run/frr(/.*)? gen_context(system_u:object_r:frr_var_run_t,s0)
/run/frr(/.*)? gen_context(system_u:object_r:frr_var_run_t,s0)
/usr/bin/vtysh -- gen_context(system_u:object_r:frr_exec_t,s0)

52
frr.if
View File

@@ -160,3 +160,55 @@ interface(`frr_admin',`
systemd_read_fifo_file_passwd_run($1)
')
')
########################################
#
# Interface compatibility blocks
#
# The following definitions ensure compatibility with distribution policy
# versions that do not contain given interfaces (epel, or older Fedora
# releases).
# Each block tests for existence of given interface and defines it if needed.
#
######################################
## <summary>
## Watch ifconfig_var_run_t directories
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
ifndef(`sysnet_watch_ifconfig_run_dirs',`
interface(`sysnet_watch_ifconfig_run_dirs',`
gen_require(`
type ifconfig_var_run_t;
')
watch_dirs_pattern($1, ifconfig_var_run_t, ifconfig_var_run_t)
')
')
########################################
## <summary>
## Read ifconfig_var_run_t files and link files
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
ifndef(`sysnet_read_ifconfig_run_files',`
interface(`sysnet_read_ifconfig_run_files',`
gen_require(`
type ifconfig_var_run_t;
')
list_dirs_pattern($1, ifconfig_var_run_t, ifconfig_var_run_t)
read_files_pattern($1, ifconfig_var_run_t, ifconfig_var_run_t)
read_lnk_files_pattern($1, ifconfig_var_run_t, ifconfig_var_run_t)
')
')

View File

@@ -5,13 +5,15 @@
%global _hardened_build 1
%global selinuxtype targeted
%define _legacy_common_support 1
%bcond_without selinux
%bcond grpc %{undefined rhel}
%bcond selinux 1
Name: frr
Version: 8.5
Release: 1%{?dist}
Version: 9.1
Release: 3%{?dist}
Summary: Routing daemon
License: GPLv2+
License: GPL-2.0-or-later AND ISC AND LGPL-2.0-or-later AND BSD-2-Clause AND BSD-3-Clause AND (GPL-2.0-or-later OR ISC) AND MIT
URL: http://www.frrouting.org
Source0: https://github.com/FRRouting/frr/releases/download/%{name}-%{version}/%{name}-%{version}.tar.gz
Source1: %{name}-tmpfiles.conf
@@ -36,8 +38,10 @@ BuildRequires: gcc
BuildRequires: gcc-c++
BuildRequires: git-core
BuildRequires: groff
%if %{with grpc}
BuildRequires: grpc-devel
BuildRequires: grpc-plugins
%endif
BuildRequires: json-c-devel
BuildRequires: libcap-devel
BuildRequires: libtool
@@ -57,6 +61,7 @@ BuildRequires: readline-devel
BuildRequires: systemd-devel
BuildRequires: systemd-rpm-macros
BuildRequires: texinfo
BuildRequires: protobuf-c-devel
Requires: ncurses
Requires: net-snmp
@@ -78,17 +83,18 @@ FRRouting is free software that manages TCP/IP based routing protocols. It takes
a multi-server and multi-threaded approach to resolve the current complexity
of the Internet.
FRRouting supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.
FRRouting supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR,
EIGRP and BFD.
FRRouting is a fork of Quagga.
%if 0%{?with_selinux}
%package selinux
Summary: Selinux policy for FRR
BuildArch: noarch
Requires: selinux-policy-%{selinuxtype}
Requires(post): selinux-policy-%{selinuxtype}
BuildRequires: selinux-policy-devel
Summary: Selinux policy for FRR
BuildArch: noarch
Requires: selinux-policy-%{selinuxtype}
Requires(post): selinux-policy-%{selinuxtype}
BuildRequires: selinux-policy-devel
%{?selinux_requires}
%description selinux
@@ -101,6 +107,8 @@ SELinux policy modules for FRR package
#Selinux
mkdir selinux
cp -p %{SOURCE3} %{SOURCE4} %{SOURCE5} selinux
# C++14 or later needed for abseil-cpp 20230125; string_view needs C++17:
sed -r -i 's/(AX_CXX_COMPILE_STDCXX\(\[)11(\])/\117\2/' configure.ac
%build
autoreconf -ivf
@@ -129,7 +137,7 @@ autoreconf -ivf
--with-crypto=openssl \
--with-vici-socket=/run/strongswan/charon.vici \
--enable-fpm \
--enable-grpc
%{?with_grpc:--enable-grpc}
%make_build MAKEINFO="makeinfo --no-split" PYTHON=%{__python3}
@@ -170,7 +178,7 @@ install -d -m 775 %{buildroot}/run/frr
%if 0%{?with_selinux}
install -D -m 644 selinux/%{name}.pp.bz2 \
%{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2
%{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2
install -D -m 644 selinux/%{name}.if %{buildroot}%{_datadir}/selinux/devel/include/distributed/%{name}.if
%endif
@@ -270,9 +278,61 @@ rm tests/lib/*grpc*
%endif
%changelog
* Wed Apr 10 2024 Michal Ruprich <mruprich@redhat.com> - 9.1-3
- Resolves: #2273524 - frr fails to start: SELinux is preventing watchfrr from create access on the sock_file
* Sun Feb 04 2024 Benjamin A. Beasley <code@musicinmybrain.net> - 9.1-2
- Rebuilt for abseil-cpp-20240116.0
* Thu Jan 25 2024 Michal Ruprich <mruprich@redhat.com> - 9.1-1
- New version 9.1
* Wed Jan 24 2024 Fedora Release Engineering <releng@fedoraproject.org> - 9.0.1-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
* Fri Jan 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 9.0.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
* Mon Oct 16 2023 Michal Ruprich <mruprich@redhat.com> - 9.0.1-1
- New version 9.0.1
* Fri Sep 01 2023 Michal Ruprich <mruprich@redhat.com> - 8.5.2-4
- Adding a couple of SELinux rules, includes fix for rhbz#2149299
* Wed Aug 30 2023 Benjamin A. Beasley <code@musicinmybrain.net> - 8.5.2-3
- Rebuilt for abseil-cpp 20230802.0
* Wed Jul 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 8.5.2-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
* Fri Jun 30 2023 Michal Ruprich <mruprich@redhat.com> - 8.5.2-1
- New version 8.5.2
- Fixing some rpmlint warnings
* Mon Jun 26 2023 Michal Ruprich <mruprich@redhat.com> - 8.5.1-4
- Resolves: #2216073 - SELinux is preventing FRR-Zebra to access to network namespaces.
* Mon Jun 05 2023 Yaakov Selkowitz <yselkowi@redhat.com> - 8.5.1-3
- Disable grpc in RHEL builds
* Fri May 19 2023 Petr Pisar <ppisar@redhat.com> - 8.5.1-2
- Rebuild against rpm-4.19 (https://fedoraproject.org/wiki/Changes/RPM-4.19)
* Wed Apr 26 2023 Michal Ruprich <mruprich@redhat.com> - 8.5.1-1
- New version 8.5.1
* Wed Apr 12 2023 Michal Ruprich <mruprich@redhat.com> - 8.5-1
- New version 8.5
* Thu Mar 23 2023 Michal Ruprich <mruprich@redhat.com> - 8.4.2-5
- Rebuilding for new abseil-cpp version
* Wed Mar 22 2023 Michal Ruprich <mruprich@redhat.com> - 8.4.2-4
- SPDX migration
* Wed Mar 08 2023 Benjamin A. Beasley <code@musicinmybrain.net> - 8.4.2-3
- Build as C++17, required by abseil-cpp 20230125
* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 8.4.2-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild

9
frr.te
View File

@@ -31,9 +31,9 @@ files_pid_file(frr_var_run_t)
#
# frr local policy
#
allow frr_t self:capability { chown dac_override dac_read_search kill net_bind_service net_raw setgid setuid net_admin };
allow frr_t self:capability { chown dac_override dac_read_search kill net_bind_service net_raw setgid setuid net_admin sys_admin };
allow frr_t self:netlink_route_socket rw_netlink_socket_perms;
allow frr_t self:packet_socket { create setopt };
allow frr_t self:packet_socket create_socket_perms;
allow frr_t self:process { setcap setpgid };
allow frr_t self:rawip_socket create_socket_perms;
allow frr_t self:tcp_socket { connect connected_stream_socket_perms };
@@ -70,6 +70,7 @@ can_exec(frr_t, frr_exec_t)
kernel_read_network_state(frr_t)
kernel_rw_net_sysctls(frr_t)
kernel_read_system_state(frr_t)
kernel_request_load_module(frr_t)
auth_use_nsswitch(frr_t)
@@ -97,6 +98,10 @@ domain_use_interactive_fds(frr_t)
fs_read_nsfs_files(frr_t)
sysnet_exec_ifconfig(frr_t)
sysnet_read_ifconfig_run_files(frr_t)
sysnet_watch_ifconfig_run_dirs(frr_t)
ipsec_domtrans_mgmt(frr_t)
userdom_read_admin_home_files(frr_t)

View File

@@ -1,2 +1,2 @@
SHA512 (frr-8.5.tar.gz) = 26a1bb752130bac684c8f83fb68d33fd16a94054904a37a9550d6028d6181663f757a700e967ae4265ca2a7c6e26b4f0d2fadcfae55a7101c6ce33ac83f2c9b9
SHA512 (frr-9.1.tar.gz) = 5e77de9d26275ac8babd3bd467fe05c7fb6fa50c80fe61e13057784945372debe24f44557d9d52e76e2e785919cdfb4d5a80e7b2a06558f2a52745d0e0b92766
SHA512 (remove-babeld-ldpd.sh) = a5bf67a3722cb20d43cef1dac28f839db68df73a1b7d34d8438e4f9366da3b67d85c1f44281f93434e8dd8ebcb2d3dc258b77eaa5627475b7395d207f020839d