knockd can't load modules, e.g. ip6_tables

[Dan Streetman]

[impact]

knockd's systemd service restricts its capabilities, so it's unable to load modules needed for changing iptables rules, e.g. ip6_tables module

[test case]

install knockd, edit /etc/default/knockd to enable it, edit /etc/knockd.conf to create a test rule, e.g.:

[test]
 sequence = 5000,5001,5002
 seq_timeout = 5
 command = ufw allow proto tcp from any to any port 22

make sure ip6_tables is not loaded on the test system.

from a separate system, perform the knocking (using the appropriate ip address):

$ knock -d 500 192.168.122.237 5000 5001 5002

check the syslog:

Apr 23 10:50:36 lp1823051 knockd[3628]: ERROR: initcaps
Apr 23 10:50:36 lp1823051 knockd[3628]: [Errno 2] modprobe: ERROR: could not insert 'ip6_tables': Operation not permitted

[regression potential]

low; any regressions would be around loading/unloading modules.

[Eric Desrochers (slashd)]

Sponsored in 'Eoan'

Proposal patch LGTM.

I don't see any debian bug against 'knockd'. Could you please make sure to forward the patch to debian as well for future sync/merge.

- Eric

[Launchpad Janitor (janitor)]

This bug was fixed in the package knockd - 0.7-1ubuntu3

---------------
knockd (0.7-1ubuntu3) eoan; urgency=medium

  * d/knockd.service:
    - Change ProtectSystem to 'true', to allow using ufw in knockd rules
      (LP: #1823051)
    - Add CAP_SYS_MODULE so knockd can load iptables modules if needed
      (LP: #1825974)

 -- Dan Streetman <email address hidden> Tue, 23 Apr 2019 06:31:56 -0400

[Brian Murray (brian-murray)]

Hello Dan, or anyone else affected,

Accepted knockd into disco-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/knockd/0.7-1ubuntu2.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-disco to verification-done-disco. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-disco. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Brian Murray (brian-murray)]

Hello Dan, or anyone else affected,

Accepted knockd into cosmic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/knockd/0.7-1ubuntu1.18.10.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-cosmic to verification-done-cosmic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-cosmic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Brian Murray (brian-murray)]

Hello Dan, or anyone else affected,

Accepted knockd into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/knockd/0.7-1ubuntu1.18.04.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Dan Streetman (ddstreet)]

disco verified using steps from test case:

ubuntu@lp1823051-d:~$ dpkg -l | grep knockd
ii knockd 0.7-1ubuntu2 amd64 small port-knock daemon

May 8 21:51:37 lp1823051-d knockd: openSSH: running command: ufw allow from any to any proto tcp port 1234
May 8 21:51:37 lp1823051-d kernel: [ 564.495227] bpfilter: Loaded bpfilter_umh pid 8409
May 8 21:51:37 lp1823051-d knockd[8321]: ERROR: initcaps
May 8 21:51:37 lp1823051-d knockd[8321]: [Errno 2] modprobe: ERROR: could not insert 'ip6_tables': Operation not permitted

ubuntu@lp1823051-d:~$ dpkg -l | grep knockd
ii knockd 0.7-1ubuntu2.1 amd64 small port-knock daemon

May 8 22:02:05 lp1823051-d knockd: openSSH: running command: ufw allow from any to any proto tcp port 1234
May 8 22:02:05 lp1823051-d knockd[20024]: Rules updated
May 8 22:02:05 lp1823051-d knockd[20024]: Rules updated (v6)

[Dan Streetman (ddstreet)]

cosmic:

ubuntu@lp1823051-c:~$ dpkg -l |grep knockd
ii knockd 0.7-1ubuntu1.18.10.1 amd64 small port-knock daemon

May 8 22:07:13 lp1823051-c knockd: openSSH: running command: ufw allow from any to any proto tcp port 1234
May 8 22:07:13 lp1823051-c kernel: [ 1492.569929] bpfilter: Loaded bpfilter_umh pid 3536
May 8 22:07:13 lp1823051-c knockd[3487]: ERROR: initcaps
May 8 22:07:13 lp1823051-c knockd[3487]: [Errno 2] modprobe: ERROR: could not insert 'ip6_tables': Operation not permitted

ubuntu@lp1823051-c:~$ dpkg -l |grep knockd
ii knockd 0.7-1ubuntu1.18.10.2 amd64 small port-knock daemon

May 8 22:10:23 lp1823051-c knockd: openSSH: running command: ufw allow from any to any proto tcp port 1234
May 8 22:10:23 lp1823051-c knockd[4196]: Rules updated
May 8 22:10:23 lp1823051-c knockd[4196]: Rules updated (v6)

[Dan Streetman (ddstreet)]

bionic:

ubuntu@lp1823051-b:~$ dpkg -l |grep knockd
ii knockd 0.7-1ubuntu1.18.04.1 amd64 small port-knock daemon

May 8 22:15:07 lp1823051-b knockd: openSSH: running command: ufw allow from any to any proto tcp port 1234
May 8 22:15:08 lp1823051-b kernel: [ 1947.848947] nf_conntrack version 0.5.0 (16384 buckets, 65536 max)
May 8 22:15:08 lp1823051-b knockd[19108]: ERROR: initcaps
May 8 22:15:08 lp1823051-b knockd[19108]: [Errno 2] modprobe: ERROR: could not insert 'ip6_tables': Operation not permitted

ubuntu@lp1823051-b:~$ dpkg -l |grep knockd
ii knockd 0.7-1ubuntu1.18.04.2 amd64 small port-knock daemon

May 8 22:17:09 lp1823051-b knockd: openSSH: running command: ufw allow from any to any proto tcp port 1234
May 8 22:17:09 lp1823051-b kernel: [ 2069.534229] ip6_tables: (C) 2000-2006 Netfilter Core Team
May 8 22:17:09 lp1823051-b knockd[19771]: Rules updated
May 8 22:17:09 lp1823051-b knockd[19771]: Rules updated (v6)

[Launchpad Janitor (janitor)]

This bug was fixed in the package knockd - 0.7-1ubuntu2.1

---------------
knockd (0.7-1ubuntu2.1) disco; urgency=medium

  * d/knockd.service:
    - Change ProtectSystem to 'true', to allow using ufw in knockd rules
      (LP: #1823051)
    - Add CAP_SYS_MODULE so knockd can load iptables modules if needed
      (LP: #1825974)

 -- Dan Streetman <email address hidden> Tue, 23 Apr 2019 06:31:56 -0400

[Łukasz Zemczak (sil2100)]

The verification of the Stable Release Update for knockd has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package knockd - 0.7-1ubuntu1.18.10.2

---------------
knockd (0.7-1ubuntu1.18.10.2) cosmic; urgency=medium

  * d/knockd.service:
    - Change ProtectSystem to 'true', to allow using ufw in knockd rules
      (LP: #1823051)
    - Add CAP_SYS_MODULE so knockd can load iptables modules if needed
      (LP: #1825974)

 -- Dan Streetman <email address hidden> Tue, 23 Apr 2019 06:40:46 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package knockd - 0.7-1ubuntu1.18.04.2

---------------
knockd (0.7-1ubuntu1.18.04.2) bionic; urgency=medium

  * d/knockd.service:
    - Change ProtectSystem to 'true', to allow using ufw in knockd rules
      (LP: #1823051)
    - Add CAP_SYS_MODULE so knockd can load iptables modules if needed
      (LP: #1825974)

 -- Dan Streetman <email address hidden> Tue, 23 Apr 2019 06:41:54 -0400