Bug 1704438
| Summary: | F30: firewalld / libvirt: Failed to load zone file '/usr/lib/firewalld/zones/libvirt.xml | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Frank Ansari <mail> |
| Component: | firewalld | Assignee: | Eric Garver <egarver> |
| Status: | CLOSED DUPLICATE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 30 | CC: | egarver, fedora, jpopelka, laine, twoerner |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-04-29 18:39:17 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Laine, I thought this was addressed by libvirt in F30. Marking as dupe of bug 1699051. *** This bug has been marked as a duplicate of bug 1699051 *** I pushed the fix upstream but not into F30 since it was in freeze. I think Cole is intending to push it into the F30 libvirt build after F30 is released (since it's only annoying, but not failure-inducing, it's better not to violate the freeze to fix it before then). |
Description of problem: This command fails: virsh net-start default Version-Release number of selected component (if applicable): firewalld-0.6.3-2.fc30.noarch How reproducible: virsh net-start default Steps to Reproduce: 1. see above 2. 3. Actual results: KVM network does not start. [root@bat zones]# virsh net-start default error: Failed to start network default error: internal error: Failed to apply firewall rules /usr/sbin/ip6tables --table filter --list-rules: ip6tables v1.8.0 (legacy): can't initialize ip6tables table `filter': Permission denied Perhaps ip6tables or your kernel needs to be upgraded. [root@bat zones]# systemctl status firewalld ● firewalld.service - firewalld - dynamic firewall daemon Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled) Active: active (running) since Mon 2019-04-29 20:08:06 CEST; 14s ago Docs: man:firewalld(1) Main PID: 9282 (firewalld) Tasks: 2 (limit: 4915) Memory: 22.8M CGroup: /system.slice/firewalld.service └─9282 /usr/bin/python3 /usr/sbin/firewalld --nofork --nopid Apr 29 20:08:06 bat.localdomain systemd[1]: Starting firewalld - dynamic firewall daemon... Apr 29 20:08:06 bat.localdomain systemd[1]: Started firewalld - dynamic firewall daemon. Apr 29 20:08:06 bat.localdomain firewalld[9282]: ERROR: Failed to load zone file '/usr/lib/firewalld/zones/libvirt.xml': PARSE_ERROR: rule: Unexpected attribute priority This is the content of /usr/lib/firewalld/zones/libvirt.xml: <?xml version="1.0" encoding="utf-8"?> <zone target="ACCEPT"> <short>libvirt</short> <description> The default policy of "ACCEPT" allows all packets to/from interfaces in the zone to be forwarded, while the (*low priority*) reject rule blocks any traffic destined for the host, except those services explicitly listed (that list can be modified as required by the local admin). This zone is intended to be used only by libvirt virtual networks - libvirt will add the bridge devices for all new virtual networks to this zone by default. </description> <rule priority='32767'> <reject/> </rule> <protocol value='icmp'/> <protocol value='ipv6-icmp'/> <service name='dhcp'/> <service name='dhcpv6'/> <service name='dns'/> <service name='ssh'/> <service name='tftp'/> </zone> Expected results: KVM network should start. Additional info: I am using Fedora 30 Silverblue.