[libvirt] libvirt 0.6.1 not playing well with RHEL5.2 lokkit

Howdy. I'm running RHEL5.2, and libvirt 0.6.1. I don't use the distro-provided firewall (system-config-securitylevel-tui-1.6.29.1-2.1.el5) and have it completely disabled, but libvirt appears to be having some trouble ascertaining as much:
libvirtd: 14:05:42.807: warning : Failed to read /etc/sysconfig/system-config-firewall last message repeated 2 times kernel: fvtebr0: Dropping NETIF_F_UFO since no NETIF_F_HW_CSUM feature. kernel: fvtebr0: starting userspace STP failed, starting kernel STP libvirtd: 14:06:34.825: error : internal error '/usr/sbin/lokkit --nostart --custom-rules=ipv4:filter:/var/lib/libvirt/iptables/filter/INPUT.chain' exited with non-zero status 1 and signal 0: --custom-rules=ipv4:filter:/var/lib/libvirt/iptables/filter/INPUT.chain: unknown option libvirtd: 14:06:34.825: warning : Failed to run '/usr/sbin/lokkit --custom-rules=ipv4:filter:/var/lib/libvirt/iptables/filter/INPUT.chain': Invalid argument libvirtd: 14:06:34.828: error : internal error '/usr/sbin/lokkit --nostart --custom-rules=ipv4:filter:/var/lib/libvirt/iptables/filter/FORWARD.chain' exited with non-zero status 1 and signal 0: --custom-rules=ipv4:filter:/var/lib/libvirt/iptables/filter/FORWARD.chain: unknown option libvirtd: 14:06:34.828: warning : Failed to run '/usr/sbin/lokkit --custom-rules=ipv4:filter:/var/lib/libvirt/iptables/filter/FORWARD.chain': Invalid argument libvirtd: 14:06:34.831: error : internal error '/usr/sbin/lokkit --nostart --custom-rules=ipv4:nat:/var/lib/libvirt/iptables/nat/POSTROUTING.chain' exited with non-zero status 1 and signal 0: --custom-rules=ipv4:nat:/var/lib/libvirt/iptables/nat/POSTROUTING.chain: unknown option libvirtd: 14:06:34.831: warning : Failed to run '/usr/sbin/lokkit --custom-rules=ipv4:nat:/var/lib/libvirt/iptables/nat/POSTROUTING.chain': Invalid argument

On Fri, Mar 06, 2009 at 09:15:27PM -0600, Charles Duffy wrote:
Howdy.
I'm running RHEL5.2, and libvirt 0.6.1. I don't use the distro-provided firewall (system-config-securitylevel-tui-1.6.29.1-2.1.el5) and have it completely disabled, but libvirt appears to be having some trouble ascertaining as much:
Hmm, I think something may have gone wrong with configure.ac checking for lokkit. The version in RHEL-5 is too old and does not support the features libvirt needs - it should only have enabled itself when it detected the lokkit from Fedora 10 or later IIRC. As a workaround set --disable-iptables-lokkit when running configure Daniel -- |: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://ovirt.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|
participants (2)
-
Charles Duffy
-
Daniel P. Berrange