Skip to content

[docker-orchagent] limit privileged flag for swss container #17598

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Dec 30, 2024
Merged

[docker-orchagent] limit privileged flag for swss container #17598

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
170b7ae
[docker-orchagent] limit privileged flag for swss container
maipbui Dec 21, 2023
e7f0f3c
Merge branch 'sonic-net:master' into swss_priv
maipbui Jan 5, 2024
6467c43
add security opts
maipbui Dec 17, 2024
0ce939b
Merge remote-tracking branch 'upstream/master' into swss_priv
maipbui Dec 17, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion rules/docker-orchagent.mk
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ SONIC_BOOKWORM_DBG_DOCKERS += $(DOCKER_ORCHAGENT_DBG)
SONIC_INSTALL_DOCKER_DBG_IMAGES += $(DOCKER_ORCHAGENT_DBG)

$(DOCKER_ORCHAGENT)_CONTAINER_NAME = swss
$(DOCKER_ORCHAGENT)_RUN_OPT += --privileged -t
$(DOCKER_ORCHAGENT)_RUN_OPT += -t --cap-add=NET_ADMIN --security-opt apparmor=unconfined --security-opt="systempaths=unconfined"
Copy link
Contributor Author

@maipbui maipbui Dec 18, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

--security-opt apparmor=unconfined --security-opt="systempaths=unconfined"

These arguments are necessary for arp/test_arp_extended.py test case

arp/test_arp_extended.py:95: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
/usr/local/lib/python3.8/dist-packages/ptf/testutils.py:3250: in verify_packet
    test.fail(
        device     = 0
        pkt        = <Ether  dst=b'fe:54:00:a3:80:01' src=22:48:23:27:33:d8 type=ARP |<ARP  op=is-at hwsrc=22:48:23:27:33:d8 psrc=192.168.0...:a3:80:01' pdst=192.168.0.3 |<Raw  load='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' |>>>
        port       = 1
        port_id    = 1
        result     = PollFailure(device=None, port=None, packet=None, time=None)
        test       = <tests.common.plugins.ptfadapter.ptfadapter.PtfTestAdapter testMethod=runTest>
        timeout    = 10
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <tests.common.plugins.ptfadapter.ptfadapter.PtfTestAdapter testMethod=runTest>
msg = 'Expected packet was not received on device 0, port 1.\n========== EXPECTED ==========\ndst        : DestMACField     ...00 00 00              ............\n========== RECEIVED ==========\n0 total packets.\n==============================\n'

    def fail(self, msg=None):
        """Fail immediately, with the given message."""
>       raise self.failureException(msg)
E       AssertionError: Expected packet was not received on device 0, port 1.
E       ========== EXPECTED ==========
E       dst        : DestMACField                        = b'fe:54:00:a3:80:01' ('None')
E       src        : SourceMACField                      = '22:48:23:27:33:d8' ('None')
E       type       : XShortEnumField                     = 2054            ('36864')
E       --
E       hwtype     : XShortEnumField                     = 1               ('1')
E       ptype      : XShortEnumField                     = 2048            ('2048')
E       hwlen      : FieldLenField                       = None            ('None')
E       plen       : FieldLenField                       = None            ('None')
E       op         : ShortEnumField                      = 2               ('1')
E       hwsrc      : MultipleTypeField (SourceMACField, StrFixedLenField) = '22:48:23:27:33:d8' ('None')
E       psrc       : MultipleTypeField (SourceIPField, SourceIP6Field, StrFixedLenField) = '192.168.0.4'   ('None')
E       hwdst      : MultipleTypeField (MACField, StrFixedLenField) = b'fe:54:00:a3:80:01' ('None')
E       pdst       : MultipleTypeField (IPField, IP6Field, StrFixedLenField) = '192.168.0.3'   ('None')
E       --
E       load       : StrField                            = b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' ("b''")
E       --
E       0000  FE 54 00 A3 80 01 22 48 23 27 33 D8 08 06 00 01  .T...."H#'3.....
E       0010  08 00 06 04 00 02 22 48 23 27 33 D8 C0 A8 00 04  ......"H#'3.....
E       0020  FE 54 00 A3 80 01 C0 A8 00 03 00 00 00 00 00 00  .T..............
E       0030  00 00 00 00 00 00 00 00 00 00 00 00              ............
E       ========== RECEIVED ==========
E       0 total packets.
E       ==============================
``` #Closed

$(DOCKER_ORCHAGENT)_RUN_OPT += -v /etc/network/interfaces:/etc/network/interfaces:ro
$(DOCKER_ORCHAGENT)_RUN_OPT += -v /etc/localtime:/etc/localtime:ro
$(DOCKER_ORCHAGENT)_RUN_OPT += -v /etc/network/interfaces.d/:/etc/network/interfaces.d/:ro
Expand Down
Loading