Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-91380

systemd-sysctl ignores config files under /run when executed from udev

Linking RHIVOS CVEs to...Migration: Automation ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Undefined Undefined
    • None
    • rhel-9.6
    • selinux-policy
    • None
    • No
    • None
    • rhel-security-selinux
    • ssg_security
    • None
    • False
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • Unspecified
    • Unspecified
    • Unspecified
    • None

      What were you trying to do that didn't work?

      I create a sysctl.d config to overwrite certain network interface parameters such as rp_filter. However it seems the config at /run/sysctl.d/99-test.conf  gets ignored by systemd-sysctl but only if it is executed by the udev rule which should apply the right sysctl parameters for the new interface.

      What is the impact of this issue to you?

      It breaks podman routing as the sysctl we are trying to set are getting overridden.

      https://issues.redhat.com/browse/RHEL-89477

      Please provide the package NVR for which the bug is seen:

      systemd-252-51.el9.x86_64

      I also observed the same behavior on fedora with systemd-256

      How reproducible is this bug?:

      always

      Steps to reproduce

      mkdir /run/sysctl.d && echo "net/ipv4/conf/test/rp_filter = 2" >/run/sysctl.d/99-test.conf && ip link add test type dummy && echo 2 > /proc/sys/net/ipv4/conf/test/rp_filter && cat /proc/sys/net/ipv4/conf/test/rp_filter && sleep 1 && cat /proc/sys/net/ipv4/conf/test/rp_filter
      

      To verify the file access we can check with bpftrace in another terminal which shows the systemd-syctl does not open the config file.

      bpftrace -e 'tracepoint:syscalls:sys_enter_openat /strcontains(str(args.filename), "rp_filter") || strcontains(str(args.filename), "99-test")/ { printf("%s %s\n", comm, str(args.filename)); }' 

      Expected results

      2
      2

      Actual results

      2
      1

      Note when I manually run /usr/lib/systemd/systemd-sysctl --prefix=/net/ipv4/conf/test from the cli the config file is read correctly and the right value is configured. So it seems related to it being executed by the udev rule.

              rhn-support-zpytela Zdenek Pytela
              pholzing@redhat.com Paul Holzinger
              Zdenek Pytela Zdenek Pytela
              SSG Security QE SSG Security QE
              Votes:
              0 Vote for this issue
              Watchers:
              8 Start watching this issue

                Created:
                Updated:
                Resolved: