Bug 1397274 - stopping firewalld times out
Summary: stopping firewalld times out
Alias: None
Product: Fedora
Classification: Fedora
Component: kernel
Version: 25
Hardware: Unspecified
OS: Unspecified
Target Milestone: ---
Assignee: Kernel Maintainer List
QA Contact: Fedora Extras Quality Assurance
Depends On:
TreeView+ depends on / blocked
Reported: 2016-11-22 06:35 UTC by Faith Ekstrand
Modified: 2019-01-09 12:54 UTC (History)
42 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2017-12-12 10:27:38 UTC
Type: Bug

Attachments (Terms of Use)
ftrace module nf_conntrack (1.11 MB, application/x-gzip)
2017-02-15 20:11 UTC, fulminemizzega
no flags Details

System ID Private Priority Status Summary Last Updated
Red Hat Bugzilla 1494985 0 high CLOSED Hosted Engine Upgrade from 3.6 to 4.0 fails with error message "Command '/bin/firewall-cmd' failed to executed" 2023-09-15 00:04:05 UTC

Internal Links: 1443015 1494985 1546445

Description Faith Ekstrand 2016-11-22 06:35:21 UTC
Description of problem:

When shutting down my laptop, firewalld fails to stop.  This, in turn, prevents drives from unmapping which prevents crypto from shutting down, etc.  In short, my laptop doesn't power off properly

Version-Release number of selected component (if applicable):


How reproducible: 100%

Additional info:

I use an encrypted drive.  Maybe firewalld doesn't like running off the initram?  I have no idea if this makes sense but it's a data point. :-)

Also, I also had this problem in Fedora 24 and there are reports of problems in Fedora 23.

Comment 1 Thomas Woerner 2016-12-14 10:12:23 UTC
Do you have errors or AVCs in the logs?

Comment 2 Eric Lin 2016-12-25 22:27:02 UTC
What happens if you try stopping firewalld while your system is running? I have the same issue and discovered that, in my case, the bug is related to bug 1294415.

Comment 3 Trevor Flynn 2017-01-05 00:52:56 UTC
Same problem here, running 4.8.15-300.fc25.x86_64 with Broadcom Limited BCM43602 on Dell XPS 9550. This is what happens when I try to stop firewalld using systemctl, I cut it short with CTRL-C because it will just hang.

$ systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
   Active: deactivating (final-sigkill) (Result: signal) since Wed 2017-01-04 15:35:02 AKST; 2min 16s ag
     Docs: man:firewalld(1)
  Process: 3277 ExecStart=/usr/sbin/firewalld --nofork --nopid $FIREWALLD_ARGS (code=killed, signal=KILL
 Main PID: 3277 (code=killed, signal=KILL)
    Tasks: 2 (limit: 4915)
   CGroup: /system.slice/firewalld.service
           ├─3154 /sbin/rmmod nf_conntrack
           └─3367 /sbin/rmmod nf_defrag_ipv6

Jan 04 15:34:39 tyeetoo systemd[1]: Starting firewalld - dynamic firewall daemon...
Jan 04 15:34:40 tyeetoo systemd[1]: Started firewalld - dynamic firewall daemon.
Jan 04 15:34:40 tyeetoo firewalld[3277]: WARNING: '/usr/sbin/iptables-restore -n' failed:
Jan 04 15:34:40 tyeetoo firewalld[3277]: WARNING: '/usr/sbin/ip6tables-restore -n' failed:
Jan 04 15:34:40 tyeetoo firewalld[3277]: ERROR: '/usr/sbin/ebtables-restore --noflush' failed:
Jan 04 15:34:40 tyeetoo firewalld[3277]: ERROR: COMMAND_FAILED
Jan 04 15:34:40 tyeetoo firewalld[3277]: ERROR: INVALID_ZONE
Jan 04 15:35:02 tyeetoo systemd[1]: Stopping firewalld - dynamic firewall daemon...
Jan 04 15:36:32 tyeetoo systemd[1]: firewalld.service: State 'stop-sigterm' timed out. Killing.
Jan 04 15:36:32 tyeetoo systemd[1]: firewalld.service: Killing process 3277 (firewalld) with signal SIGK
Jan 04 15:36:32 tyeetoo systemd[1]: firewalld.service: Killing process 3154 (rmmod) with signal SIGKILL.
Jan 04 15:36:32 tyeetoo systemd[1]: firewalld.service: Killing process 3367 (rmmod) with signal SIGKILL.
Jan 04 15:36:32 tyeetoo systemd[1]: firewalld.service: Main process exited, code=killed, status=9/KILL
Jan 04 15:36:32 tyeetoo systemd[1]: firewalld.service: Killing process 3154 (rmmod) with signal SIGKILL.
Jan 04 15:36:32 tyeetoo systemd[1]: firewalld.service: Killing process 3367 (rmmod) with signal SIGKILL.

Comment 4 Maël Lavault 2017-01-12 09:11:44 UTC
I have the same issue on Fedora 25, also had it on Fedora 24. I'm using a macbook pro mid 2015 which also has a Broadcom BCM43602 wifi chip.

Comment 5 Thomas Cameron 2017-01-17 16:15:31 UTC
I'm pretty sure bugs 1294415, 1293041, and 1397274 are all related. I'm having the same issue on my RHEL7 installations (six of them).

Comment 6 Thomas Woerner 2017-01-19 10:47:56 UTC
This is a kernel issue.

As a temporary workaround you can set CleanupOnExit=no in /etc/firewalld/firewalld.conf

Reassigning to kernel.

Comment 7 fulminemizzega 2017-02-15 20:11:44 UTC
Created attachment 1250713 [details]
ftrace module nf_conntrack

Originally posted in https://bugzilla.redhat.com/show_bug.cgi?id=1294415, I'm reposting my reply here since this is about F25:

Hello, I've run some more tests, now with F25 + kernel 4.9.9-200.fc25.x86_64 on XPS 9550 (it's using brcmfmac), I've found that if I stop and start firewalld just after boot everything works fine, instead if I stop it after some time I can reproduce the issue. I've tried to dig deeper but I don't really know what I'm doing. This is what I've found, I hope it can help:
firewalld running -> nf_conntrack has used by = 10 (from lsmod)
firewalld stop works -> lsmod | grep nf_ is empty
firewalld failing to stop -> nf_conntrack has used by = -1 (from lsmod)
used by = -1 means that the module is unloading (function module_refcount from kernel/module.c, there's a comment above); the output of lsmod | grep nf_ in this case is:
nf_reject_ipv6         16384  1 ip6t_REJECT
nf_defrag_ipv6         36864  0
nf_defrag_ipv4         16384  0
nf_conntrack          106496  -1

I booted F25 in rescue mode (add 1 to kernel cmdline), then run
 trace-cmd start -e module -f 'name == nf_conntrack'
resumed boot, run systemctl start/stop firewalld a few times, when it failed I stopped ftrace and saved the report, which I've attached here.
Is this bug also filed upstream?

Comment 8 David Juran 2017-02-20 15:56:53 UTC
Just for the record, I'm not seeing any AVC:s on my system

Comment 9 fulminemizzega 2017-02-23 23:33:51 UTC
Found another workaround, sort of: when firewalld is shutting down and hangs because of nf_conntrack, if I modprobe -r brcmfmac then firewalld shuts down fine.
In my case, I checked that "systemctl restart firewalld" would hang, then in another terminal I ran modprobe -r brcmfmac, then firewalld restarts fine. Of course I need to modprobe brcmfmac again if I want wifi back (F25, kernel 4.9.10-200 on XPS 9550 with BCM43602)

Comment 10 Justin M. Forbes 2017-04-11 14:44:51 UTC
*********** MASS BUG UPDATE **************

We apologize for the inconvenience.  There is a large number of bugs to go through and several of them have gone stale.  Due to this, we are doing a mass bug update across all of the Fedora 25 kernel bugs.

Fedora 25 has now been rebased to 4.10.9-200.fc25.  Please test this kernel update (or newer) and let us know if you issue has been resolved or if it is still present with the newer kernel.

If you have moved on to Fedora 26, and are still experiencing this issue, please change the version to Fedora 26.

If you experience different issues, please open a new bug report for those.

Comment 11 陳鐸元 2017-04-15 14:11:58 UTC
This bug is still present in 4.10.9-200.fc25.

Comment 12 huangyuyang1998 2017-05-08 02:55:05 UTC
This bug is still present in 4.10.13-200.fc25.x86_64

Comment 13 Stephen Gordon 2017-05-23 17:05:11 UTC
Still encountering this on 4.10.15-200.fc25.x86_64

Comment 14 Stephen Gordon 2017-05-23 17:07:18 UTC
(In reply to Stephen Gordon from comment #13)
> Still encountering this on 4.10.15-200.fc25.x86_64

Should also note, my wifi driver is iwlwifi not brcmfmac

Comment 15 Arif Saleem 2017-06-22 14:26:52 UTC
I have the same problem on a Dell XPS 9550.

My /home directory is encrypted. When shutting down, firewalld times out, and this also causes the luks unmount to timeout.
I can stop firewalld manually before shutdown with systemctl.
Confirmed happened upto kernel-4.11.4-200.fc25.x86_64.
I am now running kernel-4.11.5-200.fc25.x86_64 but haven't shut down yet.

Comment 16 tt 2017-06-23 03:01:40 UTC
I suffer this problem on Dell XPS 9350, Fedora 25 or 26. I commented out the line that was supposed to fix this problem, but it still stops shutdown every time. My drives are not encrypted.

Comment 17 Matt 2017-07-27 15:34:12 UTC
I can confirm that this is still happening in Fedora 26 on a Dell XPS 13 9350. I've tried the 'cockpit' workaround (https://bugzilla.redhat.com/show_bug.cgi?id=1171114) and adding 'CleanupOnExit=no' to firewalld.conf with no luck.  Seems to happen when laptop has been on for longer; issue didn't crop up when testing with short reboot cycles (i.e. rebooting after logging in).

Comment 18 Kerkko Pelttari 2017-07-30 11:58:41 UTC
Same problem with a 2015 Macbook Pro (12,1). Also no problems shutting down firewalld on "short boot cycles", like matt described.

Comment 19 Arif Saleem 2017-09-25 09:12:53 UTC
Just confirming that this still happens on my Dell XPS 15 9550. Fedora 26 64 bit, last kernel was 4.12.9.

Comment 20 Josef Šimánek 2017-10-20 02:18:59 UTC
I can confirm this is still happening on my Dell XPS 13 9350 with 4.13.5-100.fc25.x86_64 kernel.

Comment 21 Fedora End Of Life 2017-11-16 18:57:17 UTC
This message is a reminder that Fedora 25 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 25. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as EOL if it remains open with a Fedora  'version'
of '25'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version'
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not
able to fix it before Fedora 25 is end of life. If you would still like
to see this bug fixed and are able to reproduce it against a later version
of Fedora, you are encouraged  change the 'version' to a later Fedora
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's
lifetime, sometimes those efforts are overtaken by events. Often a
more recent Fedora release includes newer upstream software that fixes
bugs or makes them obsolete.

Comment 22 Fedora End Of Life 2017-12-12 10:27:38 UTC
Fedora 25 changed to end-of-life (EOL) status on 2017-12-12. Fedora 25 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this

Thank you for reporting this bug and we are sorry it could not be fixed.

Comment 23 Davide Repetto 2018-09-05 18:03:49 UTC
I still have the same problem while in Fedora 28. But only on a coule of old AMD 32bit machines.

Comment 24 Marcin Kozyra 2018-11-02 02:07:39 UTC
I still experience same issue on the fedora 29 and had it for the past few versions.

CleanupOnExit=no in /etc/firewalld/firewalld.conf works for me.

xps 9550 with BCM43602 802.11ac

Note You need to log in before you can comment on or make changes to this bug.