[rh7] ve/kmod: allow "nft_compat" module autoload from inside a Container

Submitted by Konstantin Khorenko on Oct. 31, 2019, 1:31 p.m.

Details

Message ID 20191031133113.26611-1-khorenko@virtuozzo.com
State New
Series "ve/kmod: allow "nft_compat" module autoload from inside a Container"
Headers show

Commit Message

Konstantin Khorenko Oct. 31, 2019, 1:31 p.m.
A Container with CentOS 8 inside uses nft by default and
iptables work in a legacy mode, for that "nft_compat" is
required, so allow its autoload.

 [CT]# iptables -A INPUT -m tos --tos Minimize-Cost -j REJECT
     iptables v1.8.2 (nf_tables): Couldn't load match
     `tos':No such file or directory

https://jira.sw.ru/browse/PSBM-98948

Signed-off-by: Konstantin Khorenko <khorenko@virtuozzo.com>
---
 kernel/kmod.c | 1 +
 1 file changed, 1 insertion(+)

Patch hide | download patch | download mbox

diff --git a/kernel/kmod.c b/kernel/kmod.c
index 6f0149d07bb6..26edbca07cba 100644
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -283,6 +283,7 @@  static struct {
 	{ "nf_conntrack_ipv6",	VE_NF_CONNTRACK|VE_IP_CONNTRACK },
 
 	{ "nfnetlink-subsys-10",VE_IP_IPTABLES			}, /* nf_tables */
+	{ "nfnetlink-subsys-11",VE_IP_IPTABLES			}, /* nft_compat */
 	{ "nft-set",		VE_IP_IPTABLES			},
 	{ "nft-afinfo-2",	VE_IP_IPTABLES			}, /* IPV4 */
 	{ "nft-afinfo-3",	VE_IP_IPTABLES			}, /* ARP  */

Comments

Andrey Ryabinin Oct. 31, 2019, 1:47 p.m.
On 10/31/19 4:31 PM, Konstantin Khorenko wrote:
> A Container with CentOS 8 inside uses nft by default and
> iptables work in a legacy mode, for that "nft_compat" is
> required, so allow its autoload.
> 
>  [CT]# iptables -A INPUT -m tos --tos Minimize-Cost -j REJECT
>      iptables v1.8.2 (nf_tables): Couldn't load match
>      `tos':No such file or directory
> 
> https://jira.sw.ru/browse/PSBM-98948
> 
> Signed-off-by: Konstantin Khorenko <khorenko@virtuozzo.com>
> ---

Acked-by: Andrey Ryabinin <aryabinin@virtuozzo.com>