Are there errors or AVCs in the logs?

Does not work even with ebtables-2.0.10-13.el7.x86_64

looks like ebtables module is not autoloaded on RHEL 7.3

with RHEL7.3, ebtables and ebtable_filter module are not loaded by default. Is this behavior changed with RHEL7.3? After, manually loading both these modules using "modprobe", the OpenStack VMs are getting DHCP IP addresses.

No errors (related to ebtable) are reported in /var/log/messages or  /var/log/audit/audit.log

In RHEL7.2, upon running LinuxBridge agent, both kernel modules ebtables and ebtable_filter gets automatically loaded

In RHEL7.3, upon running LinuxBridge agent, none of the kernel modules ebtables and ebtable_filter get automatically loaded which is breaking the LB functionality. Is this expected change in behavior with RHEL7.3?

As the issue also appears with ebtables-2.0.10-13.el7.x86_64 which has been part of RHEL-7.0, this can not be an ebtables package problem.

This seems to be an issue with systemd-module-load.

Reassigning to systemd.

can you post here content of:
/etc/modules-load.d/
/usr/lib/modules-load.d/

Nothing is in those folders.  Should there be something?

Good morning,

I don't believe that the systemd-module-load is the source of the behaviour here. The ebtables modules are ordinarily loaded in the context of firewalld initialization, but that shouldn't really matter. On a default Server installation, if we print the parentage of the loading process within the "module_load()" function call within the kernel, we get:

 swapper/0[0]
  -> systemd[1]
   -> firewalld[688]
    -> modprobe[734] "/sbin/modprobe ebtables" - 0x0: ebtables


However, when the firewall is disabled, the first "ebtables -L" should result in the ebtables modules being loaded:

  # lsmod | grep ebtables

  # ebtables -L
  [  541.205414] Ebtables v2.0 registered
  Bridge table: filter

  Bridge chain: INPUT, entries: 0, policy: ACCEPT

  Bridge chain: FORWARD, entries: 0, policy: ACCEPT

  Bridge chain: OUTPUT, entries: 0, policy: ACCEPT

  # lsmod | grep ebtables
  ebtables               35009  1 ebtable_filter


This is due to the ebtables library including a module loading subroutine:

  char *ebt_modprobe;
  /* Try to load the kernel module, analogous to ip_tables.c */
  int ebtables_insmod(const char *modname)
  {
        char *buf = NULL;
        char *argv[3];

        /* If they don't explicitly set it, read out of /proc */
        if (!ebt_modprobe) {
                buf = get_modprobe();
                if (!buf)
                        return -1;
                ebt_modprobe = buf; /* Keep the value for possible later use */
        }

        switch (fork()) {
        case 0:
                argv[0] = (char *)ebt_modprobe;
                argv[1] = (char *)modname;
                argv[2] = NULL;
                execv(argv[0], argv);

                /* Not usually reached */
                exit(0);
        case -1:
                return -1;

        default: /* Parent */
                wait(NULL);
        }

        return 0;
  }


Would it be possible to gather an strace of the "ebtables -L" command that is failing in the end environment?

  # strace -Tttfv -o /tmp/ebtables.strace ebtables -L

- Kyle Walker