The "ip_vs" entry in ve0_allowed_mod[] was missing its trailing comma:
/* IPVS */
"ip_vs"
"ip_vs_ftp",
C adjacent string-literal concatenation merged the two into a single
array element "ip_vsip_vs_ftp", so neither "ip_vs" nor "ip_vs_ftp"
existed as an allowlist entry. module_payload_allowed() matches with
exact strcmp() against ve0_allowed_mod[], so a container requesting the
ip_vs (or ip_vs_ftp) module was denied - which also defeated the IPVS
sockopt autoloading that nf_sockopt_request_module() relies on inside a
CT (request_module("ip_vs") then failed the allowlist check).
Add the missing comma so both module names become separate entries.
Fixes: 6983be649e95 ("ve/netfilter: Add autoloading of sockopt modules")
https://virtuozzo.atlassian.net/browse/VSTOR-132310
Signed-off-by: Konstantin Khorenko <[email protected]>
---
kernel/module/kmod.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/module/kmod.c b/kernel/module/kmod.c
index cea8ee9c09e2..ed35db21d66e 100644
--- a/kernel/module/kmod.c
+++ b/kernel/module/kmod.c
@@ -295,7 +295,7 @@ static const char * const ve0_allowed_mod[] = {
"nfsv4",
/* IPVS */
- "ip_vs"
+ "ip_vs",
"ip_vs_ftp",
"ip_vs_nq",
"ip_vs_wlc",
--
2.47.1
_______________________________________________
Devel mailing list
[email protected]
https://lists.openvz.org/mailman/listinfo/devel
