Why I did
Database privileges give RW permission to /sys. In container hardening, when remove database privileges, /sys is changed to RO permission
admin@vlab-08:~$ docker exec -it swss1 bash
root@vlab-08:/# mount | grep sys
sysfs on /sys type sysfs (ro,nosuid,nodev,noexec,relatime)
When /sys is RO, there will be some errors in vlanmgrd.
2024 Jun 12 22:14:30.915170 vlab-08 INFO swss1#supervisord: vlanmgrd sh: 1: cannot create /sys/class/net/Bridge/bridge/vlan_filtering: Read-only file system
2024 Jun 12 22:14:30.921253 vlab-08 INFO swss1#supervisord: vlanmgrd sh: 1: cannot create /sys/class/net/Bridge/bridge/no_linklocal_learn: Read-only file system
2024 Jun 12 22:14:30.922472 vlab-08 ERR swss1#vlanmgrd: :- main: Runtime error: /bin/echo 1 > /sys/class/net/Bridge/bridge/no_linklocal_learn :
2024 Jun 12 22:14:30.923562 vlab-08 INFO swss1#supervisord 2024-06-12 22:14:30,923 WARN exited: vlanmgrd (exit status 255; not expected)
What I did it
Use IP command (fallback method previously) for vlan_filtering and no_linklocal_learn, remove echo command
How I verified it
Verified locally in KVM, vlanmgrd is running
Details if related
Why I did Database privileges give RW permission to /sys. In container hardening, when remove database privileges, /sys is changed to RO permission
When /sys is RO, there will be some errors in vlanmgrd.
What I did it Use IP command (fallback method previously) for vlan_filtering and no_linklocal_learn, remove echo command How I verified it Verified locally in KVM, vlanmgrd is running Details if related