Bug 2037807

fix merged to github master branch -> https://github.com/redhat-plumbers/systemd-rhel8/pull/246

*** Bug 2040385 has been marked as a duplicate of this bug. ***

For those interested in this issue on CentOS Stream 8, the build is still under test and not eligible due to an unrelated internal infrastructure issue.  We're working to resolve that soon.

looking at the centos build in koji it failed on one test cases


155/298 test-procfs-util                          FAIL             0.32s   killed by signal 6 SIGABRT
>>> MALLOC_PERTURB_=200 SYSTEMD_KBD_MODEL_MAP=/builddir/build/BUILD/systemd-239/src/locale/kbd-model-map SYSTEMD_LANGUAGE_FALLBACK_MAP=/builddir/build/BUILD/systemd-239/src/locale/language-fallback-map PATH=/builddir/build/BUILD/systemd-239/x86_64-redhat-linux-gnu:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/sbin /builddir/build/BUILD/systemd-239/x86_64-redhat-linux-gnu/test-procfs-util
――――――――――――――――――――――――――――――――――――― ✀  ―――――――――――――――――――――――――――――――――――――
stderr:
Current system CPU time: 5month 4w 4h 23min 16.380000s
Current memory usage: 34.6G
Current number of tasks: 681
kernel.pid_max: 40960
kernel.threads-max: 1030309
Limit of tasks: 40959
Reducing limit by one to 40958…
procfs_tasks_set_limit: Permission denied
Assertion 'r >= 0 ? w == v - 1 : w == v' failed at ../src/test/test-procfs-util.c:59, function main(). Aborting.
――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――

https://koji.mbox.centos.org/koji/taskinfo?taskID=334490 

Is that the infra issue you were referring too?

(In reply to smooney from comment #10)


This is a different issue we're running into on the CentOS Stream builders. We're investigating.

OK .. Brain Stinson recommended and I tested:

Removing the dash in the line: 

-net.ipv4.ping_group_range = 0 2147483647

in /usr/lib/sysctl.d/50-default.conf

fixes the issue.

I see:

```
  Running scriptlet: systemd-239-55.el8.x86_64                            21/21 
Couldn't write '0 2147483647' to '-net/ipv4/ping_group_range', ignoring: No such file or directory

```

```
# sysctl -p 50-default.conf 
kernel.sysrq = 16
kernel.core_uses_pid = 1
kernel.kptr_restrict = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.promote_secondaries = 1
sysctl: cannot stat /proc/sys/-net/ipv4/ping_group_range: No such file or directory
net.core.default_qdisc = fq_codel
fs.protected_hardlinks = 1
fs.protected_symlinks = 1
```

Looks like we need at least https://github.com/systemd/systemd/pull/13191/commits/dec02d6e1993d420a0a94c7fec294605df55e88e as well from the original PR (https://github.com/systemd/systemd/pull/13191/commits)

*** Bug 2043500 has been marked as a duplicate of this bug. ***

(In reply to Frantisek Sumsal from comment #14)
> I see:
> 
> ```
>   Running scriptlet: systemd-239-55.el8.x86_64                           
> 21/21 
> Couldn't write '0 2147483647' to '-net/ipv4/ping_group_range', ignoring: No
> such file or directory
> 
> ```
> 
> ```
> # sysctl -p 50-default.conf 
> kernel.sysrq = 16
> kernel.core_uses_pid = 1
> kernel.kptr_restrict = 1
> net.ipv4.conf.all.rp_filter = 1
> net.ipv4.conf.all.accept_source_route = 0
> net.ipv4.conf.all.promote_secondaries = 1
> sysctl: cannot stat /proc/sys/-net/ipv4/ping_group_range: No such file or
> directory
> net.core.default_qdisc = fq_codel
> fs.protected_hardlinks = 1
> fs.protected_symlinks = 1
> ```
> 
> Looks like we need at least
> https://github.com/systemd/systemd/pull/13191/commits/
> dec02d6e1993d420a0a94c7fec294605df55e88e as well from the original PR
> (https://github.com/systemd/systemd/pull/13191/commits)

removing the - (minus sign) in the /usr/lib/sysctl.d/50-default.conf after installing systemd-239-55.el8.x86_64 works for me in 2 installs.

So changing:

-net.ipv4.ping_group_range = 0 2147483647

to

net.ipv4.ping_group_range = 0 2147483647

  

Is the minus sign a typo?

(In reply to Johnny Hughes from comment #16)
> (In reply to Frantisek Sumsal from comment #14)
> > I see:
> > 
> > ```
> >   Running scriptlet: systemd-239-55.el8.x86_64                           
> > 21/21 
> > Couldn't write '0 2147483647' to '-net/ipv4/ping_group_range', ignoring: No
> > such file or directory
> > 
> > ```
> > 
> > ```
> > # sysctl -p 50-default.conf 
> > kernel.sysrq = 16
> > kernel.core_uses_pid = 1
> > kernel.kptr_restrict = 1
> > net.ipv4.conf.all.rp_filter = 1
> > net.ipv4.conf.all.accept_source_route = 0
> > net.ipv4.conf.all.promote_secondaries = 1
> > sysctl: cannot stat /proc/sys/-net/ipv4/ping_group_range: No such file or
> > directory
> > net.core.default_qdisc = fq_codel
> > fs.protected_hardlinks = 1
> > fs.protected_symlinks = 1
> > ```
> > 
> > Looks like we need at least
> > https://github.com/systemd/systemd/pull/13191/commits/
> > dec02d6e1993d420a0a94c7fec294605df55e88e as well from the original PR
> > (https://github.com/systemd/systemd/pull/13191/commits)
> 
> removing the - (minus sign) in the /usr/lib/sysctl.d/50-default.conf after
> installing systemd-239-55.el8.x86_64 works for me in 2 installs.
> 
> So changing:
> 
> -net.ipv4.ping_group_range = 0 2147483647
> 
> to
> 
> net.ipv4.ping_group_range = 0 2147483647
> 
>   
> 
> Is the minus sign a typo?

As I mentioned in https://bugzilla.redhat.com/show_bug.cgi?id=2043500#c1 - no, the minus sign is intentional, to ignore errors (particularly in certain container solutions). Unfortunately, it turned out we were missing a couple of patches for this feature to work as advertised. This is being resolved in https://github.com/redhat-plumbers/systemd-rhel8/pull/256.

*** Bug 2043614 has been marked as a duplicate of this bug. ***

*** Bug 2043929 has been marked as a duplicate of this bug. ***

*** Bug 2048905 has been marked as a duplicate of this bug. ***

*** Bug 2048990 has been marked as a duplicate of this bug. ***

*** Bug 2049413 has been marked as a duplicate of this bug. ***

This issue is effecting RHEL 6.10 and RHEL 7 releases as well, please verify the fix when it is successfully merged on those releases as well.

(In reply to Roni Kishner from comment #23)
> This issue is effecting RHEL 6.10 and RHEL 7 releases as well, please verify
> the fix when it is successfully merged on those releases as well.

Please ignore was looking at another issue. sorry for the confusion.

*** Bug 2051329 has been marked as a duplicate of this bug. ***

fix merged to github master branch -> https://github.com/redhat-plumbers/systemd-rhel8/pull/256

Is there any ETA when this build will appear in the CentOS Stream 8?

There's no ETA for inclusion in Stream 8, but the process is working. This got pushed today:

https://git.centos.org/rpms/systemd/c/da2bf9e4d033db98743f33c925f39a0686c6628a?branch=c8s

It was just released to git.centos.org this morning. I am building it now, should go out in the next CentOS Stream 8 compose, sometime this afternoon.

The latest systemd for CentOS Stream 8 is now released (systemd-239-58.el8).  I have verified that non-privileged users can now use ICMP tools by default.

Hey, @fsumsal do you have any estimation on verifying this bug? this is a set back for our team.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (systemd bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:2069