Bug 1053760

Summary: Update to firewalld-0.3.9-1.fc20 knocked out running VMs
Product: [Fedora] Fedora Reporter: Adam Williamson <awilliam>
Component: firewalldAssignee: Thomas Woerner <twoerner>
Status: CLOSED CURRENTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 20CC: berrange, jpopelka, libvirt-maint, twoerner
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-01-16 13:01:50 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
journalctl output from around the relevant time none

Description Adam Williamson 2014-01-15 17:48:56 UTC
My server machine (which hosts an array of VMs that do the actual server-ing) did its nightly update run last night. It got firewalld-0.3.9-1.fc20 . Unfortunately, the update seemed to have a bad interaction with libvirt, and there's a whole bunch of errors in the logs right at the time the update is installed and firewalld restarted. When I woke up, none of my server VMs were online. After rebooting the host (probably not necessary, but eh, there was a new kernel anyway) they're back up. I'll attach the logs, in case there's enough here to figure out what went wrong.

Comment 1 Adam Williamson 2014-01-15 17:51:28 UTC
Created attachment 850601 [details]
journalctl output from around the relevant time

Comment 2 Adam Williamson 2014-01-15 18:00:44 UTC
danpb suggests this may be the same as https://bugzilla.redhat.com/show_bug.cgi?id=1031102 .

Comment 3 Daniel Berrangé 2014-01-15 18:03:20 UTC
0.3.9 contains the fix for the problem:

- Use rmmod instead of 'modprobe -r' (RHBZ#1031102)

of course when you upgrade to the 0.3.9 version, as part of restarting the service, the 0.3.8 version will be stopped - which triggers the flaw in that version. Only future upgrades thereafter will be safe.

Comment 4 Adam Williamson 2014-01-15 18:07:24 UTC
OK, if thomas confirms this looks like the same problem, I guess he can close this. and i'll try and keep an eye out for the next firewalld update and see if it causes the same thing.

Comment 5 Thomas Woerner 2014-01-16 13:01:50 UTC
Yes, this very much looks like the "modprobe -r" problem we had.

Closing as suggested in comment 4 with CURRENTRELEASE.