[BUG] firewalld.service fails due to missing modules
- Dominant language
- Python
- Stars
- 581
- Forks
- 397
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 9
Description
WALA invokes a few firewall rules which depend on certain kernel modules. e.g. "-m owner" and "-m conntrack" rely on xt_owner and xt_conntrack. These modules reside in kernel-modules-extra package for distros like RHEL.
Because kernel-modules-extra is not a dependency of iptables or firewalld, these rules can fail.
Culprit: https://github.com/Azure/WALinuxAgent/blob/master/azurelinuxagent/ga/firewall_manager.py#L377
This is not an issue previously because kernel package pulls in kernel-modules-extra with kernel-modules-extra-matched which is a dependency of iptables. Unfortunately this is not the case in term of UKI.
Example failure messages:
```
firewalld[8037]:
ERROR: COMMAND_FAILED: Direct: '/usr/sbin/iptables-restore -w -n' failed: Warning: Extension tcp revision 0 not supported, missing kernel module?
Warning: Extension owner revision 0 not supported, missing kernel module?
Warning: Extension conntrack revision 0 not supported, missing kernel module?
iptables-restore v1.8.11 (nf_tables):
line 3: RULE_APPEND failed (No such file or directory): rule in chain OUTPUT
line 4: RULE_APPEND failed (No such file or directory): rule in chain OUTPUT
```
Therefore, WALA should add some checks/fallbacks when these kernel modules don't exist.
Contributor guide
Assessment
This issue has not been assessed yet.