NS initialisation failure (Permission denied)

[skydevil56]

Hi!
I'm trying to get FRR to work on Debian 7 x64 (3.2.0-4-amd64 #1 SMP Debian 3.2.81-2 x86_64 GNU/Linux).
I really need it.
When i'm try to start the zebra, i'm getting error:

root@hub1:~# /usr/lib/frr/zebra
2018/03/31 18:25:35 errors: ZEBRA: NS initialisation failure (Permission denied)
2018/03/31 18:25:35 warnings: ZEBRA: Disabling MPLS support (no kernel support)

I do not need namespaces (vrf) support in FRR in my use cases. Can i disable namespace support to prevent that error?

[donaldsharp]

As far as I can tell this is just a poorly written error message and needs to be rethought a bit. Is FRR working otherwise?

[skydevil56]

FRR is working,
I tested the FRR for a short time (only BGP). I have not yet discovered any problems.
I found that in the Debian 7 operating system, the file /proc/self/ns/net has only read permissions for the root user:

root@hub1:~# ls -l /proc/self/ns/net
-r-------- 1 root root 0 Apr  1 10:52 /proc/self/ns/net

The FRR runs as a frr user, and therefore the FRR does not have access to the /proc/self/ns/net.

[pguibert6WIND]

Getting the file descriptor for default NS is necessary to switch back to default VRF.
Maybe playing with linux capabilities may help in solving that ?

[skydevil56]

What do you mean when you say "playing with linux capabilities"?

[pguibert6WIND]

I need to do some testing before.
Basically, there are some privileges that the code can use to be able to read that file.
So, I will do that.
In the meantime, you can try to do the following

setcap 'cap_sys_admin' /usr/bin/zebra

I expect that this should permit zebra daemon to be able to read that file.

[pguibert6WIND]

Hello @skydevil56 , which frr release do you need for that ?
What you want is starting zebra without errors on your platform; also you dont want to use netns for now.

If that is the case, then you should retry on the last FRR release. the error message disappeared.
I think the initialisation will be ok.

1. If there is still the error, I can, help to fix it.
2. If you need an other FRR release, please tell me, we can eventually do backporting.
3. If you need to make netns work on your setup, then I am willing to help you too.

but lets clarify the goals of this ticket which is 1) and 2).

[qlyoung]

No activity.