Benign SE Linux violations caused by FRR scripts

[DanPartelly]

I've recently switched to a full SELinux-hardened setup for my workstations. My SELinux policy config is in progress. We have a benign SELinux violation in Netlab. And because this is benign, this is a discussion, not a PR.

Most probably related to logging from FRR containers, judging by /proc/fd/being involved. Still, we should get rid of it, if possible. It pollutes logs.

type=AVC msg=audit(1783093998.996:4931): avc: denied { write } for pid=110656 comm="01-initial.sh" name="fd" dev="proc" ino=1195701 scontext=system_u:system_r:container_runtime_t:s0 tcontext=system_u:system_r:spc_t:s0 tclass=dir permissive=0

[jbemmel]

Could be due to #3541 ?

[ipspace]

Could be due to #3541 ?

I had bad feeling about that one from the start :( We should make it configurable (disabled by default), it's useful mostly to retain logs when FRR crashes and the container dies, otherwise you can do "netlab connect x tail -f /var/log/frr/logfile"

[jbemmel]

We can make it conditional on debug options being set

[jbemmel]

otherwise you can do "netlab connect x tail -f /var/log/frr/logfile"

Maybe a netlab logs command would be useful?

[DanPartelly]

Likely. The involved fd is stdout.