Bug 1999152

+++ This bug was initially created as a clone of Bug #1999102 +++

Description of problem:
With default capabilities (NET_ADMIN, NET_RAW), firewalld
is unable to insert nf_nat_ftp module when activating the ftp service.

Version-Release number of selected component (if applicable):
firewalld-1.0.0-2.el9

How reproducible:
Always.

Steps to Reproduce:
1. start firewalld with --debug
2. firewall-cmd --add-service ftp
3. /var/log/firewalld contains "modprobe: ERROR: could not insert 'nf_nat_ftp': Operation not permitted"

Actual results:
[root@ci-vm-10-0-137-226 ~]# rpm -q selinux-policy firewalld
selinux-policy-34.1.14-1.el9.noarch
firewalld-1.0.0-2.el9.noarch
[root@ci-vm-10-0-137-226 ~]# sed -i -e 's/^\(FIREWALLD_ARGS=\).*$/\1--debug/' /etc/sysconfig/firewalld
[root@ci-vm-10-0-137-226 ~]# cat /etc/sysconfig/firewalld
# firewalld command line args
# possible values: --debug
FIREWALLD_ARGS=--debug
[root@ci-vm-10-0-137-226 ~]# systemctl start firewalld
[root@ci-vm-10-0-137-226 ~]# firewall-cmd --add-service ftp
success
[root@ci-vm-10-0-137-226 ~]# grep ERROR /var/log/firewalld
2021-08-30 07:41:53 DEBUG1: modprobe: ERROR: could not insert 'nf_nat_ftp': Operation not permitted


Expected results:
The module insertion succeeds.

Additional info:
When firewalld runs with full capabilities the problem does not occur (the module is inserted successfully).

--- Additional comment from Eric Garver on 2021-08-30 14:07:47 UTC ---

So we do need CAP_SYS_MODULE in RHEL-9. I'm passing this to selinux-policy so they can update the firewalld policy.

--- Additional comment from Eric Garver on 2021-08-30 14:13:12 UTC ---

(In reply to Eric Garver from comment #1)
> So we do need CAP_SYS_MODULE in RHEL-9. I'm passing this to selinux-policy
> so they can update the firewalld policy.

My bad. We still nede the firewalld bug to backport:

  13801962073f ("fix(firewalld): keep linux capability CAP_SYS_MODULE")