-
Bug
-
Resolution: Done
-
Undefined
-
None
-
rhel-9.6
-
None
-
No
-
None
-
rhel-security-selinux
-
ssg_security
-
None
-
False
-
False
-
-
None
-
None
-
None
-
None
-
Unspecified
-
Unspecified
-
Unspecified
-
None
What were you trying to do that didn't work?
I create a sysctl.d config to overwrite certain network interface parameters such as rp_filter. However it seems the config at /run/sysctl.d/99-test.conf gets ignored by systemd-sysctl but only if it is executed by the udev rule which should apply the right sysctl parameters for the new interface.
What is the impact of this issue to you?
It breaks podman routing as the sysctl we are trying to set are getting overridden.
https://issues.redhat.com/browse/RHEL-89477
Please provide the package NVR for which the bug is seen:
systemd-252-51.el9.x86_64
I also observed the same behavior on fedora with systemd-256
How reproducible is this bug?:
always
Steps to reproduce
mkdir /run/sysctl.d && echo "net/ipv4/conf/test/rp_filter = 2" >/run/sysctl.d/99-test.conf && ip link add test type dummy && echo 2 > /proc/sys/net/ipv4/conf/test/rp_filter && cat /proc/sys/net/ipv4/conf/test/rp_filter && sleep 1 && cat /proc/sys/net/ipv4/conf/test/rp_filter
To verify the file access we can check with bpftrace in another terminal which shows the systemd-syctl does not open the config file.
bpftrace -e 'tracepoint:syscalls:sys_enter_openat /strcontains(str(args.filename), "rp_filter") || strcontains(str(args.filename), "99-test")/ { printf("%s %s\n", comm, str(args.filename)); }'
Expected results
2 2
Actual results
2 1
Note when I manually run /usr/lib/systemd/systemd-sysctl --prefix=/net/ipv4/conf/test from the cli the config file is read correctly and the right value is configured. So it seems related to it being executed by the udev rule.
- blocks
-
RHEL-89477 [netavark-1.16] rp_filter is set to 1 breaking asymetric routing in podman
-
- Release Pending
-
- causes
-
SAT-39069 Installer fails to enable IoP on disconnected setups, when podman's Host.NetworkBackend is set as CNI
-
- Review
-