commit 28cf3b7da279c0755f6dc345c0973d1e3017e9ca
author Billy McFall <bmcfall@redhat.com> Mon Jan 15 17:54:52 2018 -0500
committer Damjan Marion <dmarion.lists@gmail.com> Tue Jan 30 13:26:20 2018 +0000
tree ff82873f655f6b52e1673df75f3a12b19c106fde
parent c0379aec241c78fe07074fa7e63a5009a4e7944a

VPP-899: Run VPP under SELinux

Add an SELinux profile such that VPP can run under SELinux on RPM based
platforms. The SELinux Policy is currently only implemented for RPM
packages, specifically, Fedora, CentOS and RHEL. Doxygen User
Documentation has been included (selinux_doc.md). Once some discussion
on file locations has completed (see vpp-devlist), updates to the Debug
CLI documentation will also need to be updated.

Additional changes:
Patch Set 2:
- Rework selinux_doc.md such that each line is only 80 characters
  instead of each sentence on a line. Made additonal minor chnages
  to the text.
- Update vHost Debug CLI documentation to reflex new socket location.
  Cleaned up some text from when I originally wrote it, to better
  reflex proper use.
- Update exec Debug CLI documentation to be more inline with suggested
  helptext, added text regarding recommended script file location.
- For Debian builds, create the /var/log/vpp/ directory. I don't use
  Debian very much, so please pay extra attention to
  build-data/platforms.mk and build-root/deb/debian/.gitignore.
- Per discussion on VPP call, changed the default log location to
  /var/log/vpp/vpp.log.
- Changed the socket location for vHost in AutoConfig to
  /var/run/vpp/.
Patch Set 3:
- Update selinux_doc.md based on comments.

Change-Id: I400520dc33f1ca51012d09ef8fe5a7b7b96c631e
Signed-off-by: Billy McFall <bmcfall@redhat.com>

extras/vpp_config/data/startup.conf.template

diff --git a/extras/vpp_config/data/startup.conf.template b/extras/vpp_config/data/startup.conf.template
index 91b92c6..912bbc4 100644
--- a/extras/vpp_config/data/startup.conf.template
+++ b/extras/vpp_config/data/startup.conf.template
@@ -1,7 +1,7 @@
 
 unix {{
 {unix}
-  log /tmp/vpp.log
+  log /var/log/vpp/vpp.log
   full-coredump
   cli-listen /run/vpp/cli.sock
 }}

extras/vpp_config/vpplib/AutoConfig.py

diff --git a/extras/vpp_config/vpplib/AutoConfig.py b/extras/vpp_config/vpplib/AutoConfig.py
index 36b6833..26603e8 100644
--- a/extras/vpp_config/vpplib/AutoConfig.py
+++ b/extras/vpp_config/vpplib/AutoConfig.py
@@ -1637,7 +1637,7 @@
             question = "Would you like connect this interface {} to the VM [Y/n]? ".format(name)
             answer = self._ask_user_yn(question, 'y')
             if answer == 'y':
-                sockfilename = '/tmp/sock{}.sock'.format(inum)
+                sockfilename = '/var/run/vpp/sock{}.sock'.format(inum)
                 if os.path.exists(sockfilename):
                     os.remove(sockfilename)
                 cmd = 'vppctl create vhost-user socket {} server'.format(sockfilename)
@@ -1679,7 +1679,7 @@
             for intf in ints_with_vints:
                 vhoststr = 'comment { The following command creates the socket }\n'
                 vhoststr += 'comment { and returns a virtual interface }\n'
-                vhoststr += 'comment {{ create vhost-user socket /tmp/sock{}.sock server }}\n'. \
+                vhoststr += 'comment {{ create vhost-user socket /var/run/vpp/sock{}.sock server }}\n'. \
                     format(intf['bridge'])
 
                 setintdnstr = 'set interface state {} down\n'.format(intf['name'])