[RHEL7,COMMIT] ve/kmod: make nfnetlink_log autoloadable upon request from a CT

Submitted by Vasily Averin on Oct. 29, 2020, 1:56 p.m.

Details

Message ID 202010291356.09TDuLLh005329@vz7build.vvs.sw.ru
State New
Series "ve/kmod: make nfnetlink_log autoloadable upon request from a CT"
Headers show

Commit Message

Vasily Averin Oct. 29, 2020, 1:56 p.m. 
The commit is pushed to "branch-rh7-3.10.0-1127.18.2.vz7.163.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-1127.18.2.vz7.163.41
------>
commit b1dee036d79beaec1e542ee15d5ea5be8b582625
Author: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
Date:   Thu Oct 29 16:56:20 2020 +0300

    ve/kmod: make nfnetlink_log autoloadable upon request from a CT
    
    We see that k8s_weave-npc container fails with:
    
    Thu Oct 29 09:19:53 2020 <5> ulogd.c:981 building new pluginstance stack: 'log1:NFLOG,base1:BASE,pcap1:PCAP'
    Thu Oct 29 09:19:53 2020 <7> ulogd_inppkt_NFLOG.c:552 unable to bind to log group 86
    Thu Oct 29 09:19:53 2020 <7> ulogd.c:948 error starting `log1'
    Thu Oct 29 09:19:53 2020 <8> ulogd.c:1597 not even a single working plugin stack
    Fatal error.
    
    It needs nfnetlink_log module to be loaded. Need this to be able to run
    kubernetes in centos-8 containers where it uses nft logs.
    
    https://jira.sw.ru/browse/PSBM-121652
    
    Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
---
 kernel/kmod.c | 5 +++++
 1 file changed, 5 insertions(+)

Patch hide | download patch | download mbox 

diff --git a/kernel/kmod.c b/kernel/kmod.c
index de2bcfd..0446891 100644
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -367,6 +367,10 @@  static struct {
 	{ "nf-logger-2-0",	VE_IP_IPTABLES			},
 	{ "nf-logger-7-0",	VE_IP_IPTABLES			}, /* bridge */
 	{ "nf-logger-10-0",	VE_IP_IPTABLES6			},
+
+	{ "nf-logger-2-1",      VE_IP_IPTABLES			},
+	{ "nf-logger-7-1",      VE_IP_IPTABLES			},
+	{ "nf-logger-10-1",     VE_IP_IPTABLES6			},
 };
 
 /*
@@ -471,6 +475,7 @@  static const char * const ve0_allowed_mod[] = {
 	"nfnetlink-subsys-1",		/* NFNL_SUBSYS_CTNETLINK */
 	"nfnetlink-subsys-2",		/* NFNL_SUBSYS_CTNETLINK_EXP */
 	"nfnetlink-subsys-3",		/* NFNL_SUBSYS_QUEUE */
+	"nfnetlink-subsys-4",		/* NFNL_SUBSYS_ULOG */
 
 	/* unix_diag */
 	"net-pf-16-proto-4-type-1",	/* PF_NETLINK, NETLINK_SOCK_DIAG, AF_LOCAL */