client/fingerprint: detect unloaded dynamic bridge kernel module #9299
Conversation
In Nomad v0.12.0, the client added additional fingerprinting around the presense of the bridge kernel module. The fingerprinter only checked in `/proc/modules` which is a list of loaded modules. In some cases, the bridge kernel module is builtin rather than dynamically loaded. The fix for that case is in #8721. However we were still missing the case where the bridge module is dynamically loaded, but not yet loaded during the startup of the Nomad agent. In this case the fingerprinter would believe the bridge module was unavailable when really it gets loaded on demand. This PR now has the fingerprinter scan the kernel module dependency file, which will contain an entry for the bridge module even if it is not yet loaded. In summary, the client now looks for the bridge kernel module in - /proc/modules - /lib/modules/<kernel>/modules.builtin - /lib/modules/<kernel>/modules.dep Closes #8423
|
This is trying hard to avoid an |
There was a problem hiding this comment.
LGTM 👍
I took a look at the source of modprobe and the output of strace while searching for a bogus module and it looks like this should work.
One small caveat is that modprobe has configuration values that can tell it to look elsewhere; in practice I suspect this isn't something that's going to impact bridge but we should at least have that in the back of our mind if we get a report about someone's exotic setup later down the road.
|
Hi @shoenig, on which systems did you check this PR? @jeroentbt ran over this in Gitter and told me that he uses CentOS. When I checked against my CentOS 7 boxes they do have the following in would it be possible to include |
|
I'm going to lock this pull request because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active contributions. |
In Nomad v0.12.0, the client added additional fingerprinting around the
presense of the bridge kernel module. The fingerprinter only checked in
/proc/moduleswhich is a list of loaded modules. In some cases, thebridge kernel module is builtin rather than dynamically loaded. The fix
for that case is in #8721. However we were still missing the case where
the bridge module is dynamically loaded, but not yet loaded during the
startup of the Nomad agent. In this case the fingerprinter would believe
the bridge module was unavailable when really it gets loaded on demand.
This PR now has the fingerprinter scan the kernel module dependency file,
which will contain an entry for the bridge module even if it is not yet
loaded.
In summary, the client now looks for the bridge kernel module in
/proc/modules/lib/modules/<kernel>/modules.builtin/lib/modules/<kernel>/modules.depCloses #8423