Description of problem: When shutting down my laptop, firewalld fails to stop. This, in turn, prevents drives from unmapping which prevents crypto from shutting down, etc. In short, my laptop doesn't power off properly Version-Release number of selected component (if applicable): firewalld-0.4.3.3-1.fc25.noarch systemd-231-10.fc25.x86_64 kernel-4.8.8-300.fc25.x86_64 How reproducible: 100% Additional info: I use an encrypted drive. Maybe firewalld doesn't like running off the initram? I have no idea if this makes sense but it's a data point. :-) Also, I also had this problem in Fedora 24 and there are reports of problems in Fedora 23.
Do you have errors or AVCs in the logs?
What happens if you try stopping firewalld while your system is running? I have the same issue and discovered that, in my case, the bug is related to bug 1294415.
Same problem here, running 4.8.15-300.fc25.x86_64 with Broadcom Limited BCM43602 on Dell XPS 9550. This is what happens when I try to stop firewalld using systemctl, I cut it short with CTRL-C because it will just hang. $ systemctl status firewalld ● firewalld.service - firewalld - dynamic firewall daemon Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled) Active: deactivating (final-sigkill) (Result: signal) since Wed 2017-01-04 15:35:02 AKST; 2min 16s ag Docs: man:firewalld(1) Process: 3277 ExecStart=/usr/sbin/firewalld --nofork --nopid $FIREWALLD_ARGS (code=killed, signal=KILL Main PID: 3277 (code=killed, signal=KILL) Tasks: 2 (limit: 4915) CGroup: /system.slice/firewalld.service ├─3154 /sbin/rmmod nf_conntrack └─3367 /sbin/rmmod nf_defrag_ipv6 Jan 04 15:34:39 tyeetoo systemd[1]: Starting firewalld - dynamic firewall daemon... Jan 04 15:34:40 tyeetoo systemd[1]: Started firewalld - dynamic firewall daemon. Jan 04 15:34:40 tyeetoo firewalld[3277]: WARNING: '/usr/sbin/iptables-restore -n' failed: Jan 04 15:34:40 tyeetoo firewalld[3277]: WARNING: '/usr/sbin/ip6tables-restore -n' failed: Jan 04 15:34:40 tyeetoo firewalld[3277]: ERROR: '/usr/sbin/ebtables-restore --noflush' failed: Jan 04 15:34:40 tyeetoo firewalld[3277]: ERROR: COMMAND_FAILED Jan 04 15:34:40 tyeetoo firewalld[3277]: ERROR: INVALID_ZONE Jan 04 15:35:02 tyeetoo systemd[1]: Stopping firewalld - dynamic firewall daemon... Jan 04 15:36:32 tyeetoo systemd[1]: firewalld.service: State 'stop-sigterm' timed out. Killing. Jan 04 15:36:32 tyeetoo systemd[1]: firewalld.service: Killing process 3277 (firewalld) with signal SIGK Jan 04 15:36:32 tyeetoo systemd[1]: firewalld.service: Killing process 3154 (rmmod) with signal SIGKILL. Jan 04 15:36:32 tyeetoo systemd[1]: firewalld.service: Killing process 3367 (rmmod) with signal SIGKILL. Jan 04 15:36:32 tyeetoo systemd[1]: firewalld.service: Main process exited, code=killed, status=9/KILL Jan 04 15:36:32 tyeetoo systemd[1]: firewalld.service: Killing process 3154 (rmmod) with signal SIGKILL. Jan 04 15:36:32 tyeetoo systemd[1]: firewalld.service: Killing process 3367 (rmmod) with signal SIGKILL.
I have the same issue on Fedora 25, also had it on Fedora 24. I'm using a macbook pro mid 2015 which also has a Broadcom BCM43602 wifi chip.
I'm pretty sure bugs 1294415, 1293041, and 1397274 are all related. I'm having the same issue on my RHEL7 installations (six of them).
This is a kernel issue. As a temporary workaround you can set CleanupOnExit=no in /etc/firewalld/firewalld.conf Reassigning to kernel.
Created attachment 1250713 [details] ftrace module nf_conntrack Originally posted in https://bugzilla.redhat.com/show_bug.cgi?id=1294415, I'm reposting my reply here since this is about F25: Hello, I've run some more tests, now with F25 + kernel 4.9.9-200.fc25.x86_64 on XPS 9550 (it's using brcmfmac), I've found that if I stop and start firewalld just after boot everything works fine, instead if I stop it after some time I can reproduce the issue. I've tried to dig deeper but I don't really know what I'm doing. This is what I've found, I hope it can help: firewalld running -> nf_conntrack has used by = 10 (from lsmod) firewalld stop works -> lsmod | grep nf_ is empty firewalld failing to stop -> nf_conntrack has used by = -1 (from lsmod) used by = -1 means that the module is unloading (function module_refcount from kernel/module.c, there's a comment above); the output of lsmod | grep nf_ in this case is: nf_reject_ipv6 16384 1 ip6t_REJECT nf_defrag_ipv6 36864 0 nf_defrag_ipv4 16384 0 nf_conntrack 106496 -1 I booted F25 in rescue mode (add 1 to kernel cmdline), then run trace-cmd start -e module -f 'name == nf_conntrack' resumed boot, run systemctl start/stop firewalld a few times, when it failed I stopped ftrace and saved the report, which I've attached here. Is this bug also filed upstream?
Just for the record, I'm not seeing any AVC:s on my system
Found another workaround, sort of: when firewalld is shutting down and hangs because of nf_conntrack, if I modprobe -r brcmfmac then firewalld shuts down fine. In my case, I checked that "systemctl restart firewalld" would hang, then in another terminal I ran modprobe -r brcmfmac, then firewalld restarts fine. Of course I need to modprobe brcmfmac again if I want wifi back (F25, kernel 4.9.10-200 on XPS 9550 with BCM43602)
*********** MASS BUG UPDATE ************** We apologize for the inconvenience. There is a large number of bugs to go through and several of them have gone stale. Due to this, we are doing a mass bug update across all of the Fedora 25 kernel bugs. Fedora 25 has now been rebased to 4.10.9-200.fc25. Please test this kernel update (or newer) and let us know if you issue has been resolved or if it is still present with the newer kernel. If you have moved on to Fedora 26, and are still experiencing this issue, please change the version to Fedora 26. If you experience different issues, please open a new bug report for those.
This bug is still present in 4.10.9-200.fc25.
This bug is still present in 4.10.13-200.fc25.x86_64
Still encountering this on 4.10.15-200.fc25.x86_64
(In reply to Stephen Gordon from comment #13) > Still encountering this on 4.10.15-200.fc25.x86_64 Should also note, my wifi driver is iwlwifi not brcmfmac
I have the same problem on a Dell XPS 9550. My /home directory is encrypted. When shutting down, firewalld times out, and this also causes the luks unmount to timeout. I can stop firewalld manually before shutdown with systemctl. Confirmed happened upto kernel-4.11.4-200.fc25.x86_64. I am now running kernel-4.11.5-200.fc25.x86_64 but haven't shut down yet.
I suffer this problem on Dell XPS 9350, Fedora 25 or 26. I commented out the line that was supposed to fix this problem, but it still stops shutdown every time. My drives are not encrypted.
I can confirm that this is still happening in Fedora 26 on a Dell XPS 13 9350. I've tried the 'cockpit' workaround (https://bugzilla.redhat.com/show_bug.cgi?id=1171114) and adding 'CleanupOnExit=no' to firewalld.conf with no luck. Seems to happen when laptop has been on for longer; issue didn't crop up when testing with short reboot cycles (i.e. rebooting after logging in).
Same problem with a 2015 Macbook Pro (12,1). Also no problems shutting down firewalld on "short boot cycles", like matt described.
Just confirming that this still happens on my Dell XPS 15 9550. Fedora 26 64 bit, last kernel was 4.12.9.
I can confirm this is still happening on my Dell XPS 13 9350 with 4.13.5-100.fc25.x86_64 kernel.
This message is a reminder that Fedora 25 is nearing its end of life. Approximately 4 (four) weeks from now Fedora will stop maintaining and issuing updates for Fedora 25. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as EOL if it remains open with a Fedora 'version' of '25'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version. Thank you for reporting this issue and we are sorry that we were not able to fix it before Fedora 25 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged change the 'version' to a later Fedora version prior this bug is closed as described in the policy above. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete.
Fedora 25 changed to end-of-life (EOL) status on 2017-12-12. Fedora 25 is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug. If you can reproduce this bug against a currently maintained version of Fedora please feel free to reopen this bug against that version. If you are unable to reopen this bug, please file a new report against the current release. If you experience problems, please add a comment to this bug. Thank you for reporting this bug and we are sorry it could not be fixed.
I still have the same problem while in Fedora 28. But only on a coule of old AMD 32bit machines.
I still experience same issue on the fedora 29 and had it for the past few versions. CleanupOnExit=no in /etc/firewalld/firewalld.conf works for me. xps 9550 with BCM43602 802.11ac