search

sonic-net / sonic-swss

SONiC Switch State Service (SwSS)
https://azure.github.io/SONiC
Other
170 stars 503 forks source link

[vlanmgr] use IP command for vlan_filtering and no_linklocal_learn, remove echo command #3198

Closed maipbui closed 2 months ago

maipbui commented 2 months ago

Why I did Database privileges give RW permission to /sys. In container hardening, when remove database privileges, /sys is changed to RO permission

admin@vlab-08:~$ docker exec -it swss1 bash
root@vlab-08:/# mount | grep sys
sysfs on /sys type sysfs (ro,nosuid,nodev,noexec,relatime)

When /sys is RO, there will be some errors in vlanmgrd.

2024 Jun 12 22:14:30.915170 vlab-08 INFO swss1#supervisord: vlanmgrd sh: 1: cannot create /sys/class/net/Bridge/bridge/vlan_filtering: Read-only file system
2024 Jun 12 22:14:30.921253 vlab-08 INFO swss1#supervisord: vlanmgrd sh: 1: cannot create /sys/class/net/Bridge/bridge/no_linklocal_learn: Read-only file system
2024 Jun 12 22:14:30.922472 vlab-08 ERR swss1#vlanmgrd: :- main: Runtime error: /bin/echo 1 > /sys/class/net/Bridge/bridge/no_linklocal_learn :
2024 Jun 12 22:14:30.923562 vlab-08 INFO swss1#supervisord 2024-06-12 22:14:30,923 WARN exited: vlanmgrd (exit status 255; not expected)

What I did it Use IP command (fallback method previously) for vlan_filtering and no_linklocal_learn, remove echo command How I verified it Verified locally in KVM, vlanmgrd is running Details if related

maipbui commented 2 months ago

@prsunny could you help review this PR?

maipbui commented 2 months ago

@prsunny could you help review this PR?