Public bug reported:

/usr/share/netfilter-persistent/plugins.d/15-ip4tables contains two
lines of interest:

set -e
/sbin/modprobe -q iptable_filter

modprobe failure causes entire script to exit with 1 status immediately.

Processes run inside of containers (such as LXC and LXD) can't really
load modules, and kernel modules usually aren't even installed anyway:

root@t1:~# /sbin/modprobe iptable_filter
modprobe: ERROR: ../libkmod/libkmod.c:586 kmod_search_moddep() could not open 
moddep file '/lib/modules/4.15.0-46-generic/modules.dep.bin'
modprobe: FATAL: Module iptable_filter not found in directory 

However, iptables will generally work inside containers, provided that
the required modules were loaded outside the container.

So instead of failing, I think modprobe errors should be just ignored
(|| true).

This seems to be the same bug as #1002078, which apparently got
reintroduced during code rewrite.

ProblemType: Bug
DistroRelease: Ubuntu 18.04
Package: netfilter-persistent 1.0.4+nmu2
ProcVersionSignature: Ubuntu 4.15.0-46.49-generic 4.15.18
Uname: Linux 4.15.0-46-generic x86_64
NonfreeKernelModules: xt_REDIRECT nf_nat_redirect xt_tcpudp iptable_nat 
nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack xt_addrtype 
iptable_filter binfmt_misc veth ebtable_filter ebtables bridge stp llc 
snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hda_core snd_hwdep 
snd_pcm input_leds joydev serio_raw snd_timer snd soundcore mac_hid 
sch_fq_codel ib_iser rdma_cm iw_cm ib_cm ib_core iscsi_tcp libiscsi_tcp 
libiscsi scsi_transport_iscsi ip_tables x_tables autofs4 btrfs zstd_compress 
raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor 
raid6_pq libcrc32c raid1 raid0 multipath linear hid_generic usbhid hid 
crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel aes_x86_64 
crypto_simd qxl glue_helper ttm cryptd drm_kms_helper syscopyarea sysfillrect 
sysimgblt fb_sys_fops psmouse sym53c8xx scsi_transport_spi drm virtio_blk 
pata_acpi i2c_piix4 virtio_net floppy
ApportVersion: 2.20.9-0ubuntu7.6
Architecture: amd64
Date: Fri Mar 15 00:06:17 2019
PackageArchitecture: all
 PATH=(custom, no user)
SourcePackage: iptables-persistent
UpgradeStatus: No upgrade log present (probably fresh install)

** Affects: iptables-persistent (Ubuntu)
     Importance: Undecided
         Status: New

** Tags: amd64 apport-bug bionic uec-images

You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.

  iptables-persistent fails in containers due to modprobe being
  unavailable even though module could've been loaded outside of the

To manage notifications about this bug go to:

ubuntu-bugs mailing list

Reply via email to