Dear Maintainer,

I recently upgraded software on a server which was running (among other things)
several
LXC containers via libvirt. Before the upgrade the containers worked fine;
after, the system refuses to allow any LXC containers to be created.

Both using virsh from the command line and using virt-manager to create an LXC
container
result in the message
"System lacks NETNS support"

Looking at the package source for libvirt-daemon-driver-lxc, the function
lxcCheckNetNsSupport in the file src/lxc/lxc_driver.c seems to be testing for
NETNS
support using the command "ip link set lo netns -1".

Comparing the server where I did the software upgrade with another which I
haven't upgraded,
the output of that ip command is different. On the upgraded server, 'ip link
set lo netns -1'
outpus 'Error: argument "-1" is wrong: Invalid "netns" value'.
On the unupgraded one where LXC containers still work, the same command outputs
'RTNETLINK answers: Operation not permitted'
and if I run it with sudo,
'RTNETLINK answers: No such process'
So I think the way that ip responds to invalid input has changed, which might
be
the reason libvirt is not correctly detecting NETNS support anymore.
While this implies the actual change occurred in ip, if it's a persistent
change then libvirt-daemon-driver-lxc will need to change to handle it.

Before the upgrade, libvirt-daemon-driver-lxc was on version 10-6-0.1 and
iproute2
(the package providing the ip command) was on 6.11.0-1. After the upgrade
libvirt-daemon-driver-lxc was on 10-9-0.1 and iproute2 was on 6.12.0-1.

Thank you.

Hello,

FYI I reported this problem on OFTC #virt and was advised to post
a patch to remove the check, which I did (see below). Also
attached in case my webmail mangles it.

Regards,

Leigh.

Since iproute2 v6.12.0, the command "ip link set lo netns -1" can
no longer be used to check for netns support, as it now validates
PIDs are not less than zero.

Since every kernel we care about has the support, just remove the
check.

Signed-off-by: Leigh Brown <leigh@solinno.co.uk>
---
  src/lxc/lxc_conf.h   |  1 -
  src/lxc/lxc_driver.c | 36 ------------------------------------
  2 files changed, 37 deletions(-)

diff --git a/src/lxc/lxc_conf.h b/src/lxc/lxc_conf.h
index c0967ac63b..a639e3989f 100644
--- a/src/lxc/lxc_conf.h
+++ b/src/lxc/lxc_conf.h
@@ -49,7 +49,6 @@ struct _virLXCDriverConfig {
      char *stateDir;
      char *logDir;
      bool log_libvirtd;
-    int have_netns;

      char *securityDriverName;
      bool securityDefaultConfined;
diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c
index d682e7168a..2488940feb 100644
--- a/src/lxc/lxc_driver.c
+++ b/src/lxc/lxc_driver.c
@@ -422,12 +422,6 @@ lxcDomainDefineXMLFlags(virConnectPtr conn, const
char *xml, unsigned int flags)
      if (virSecurityManagerVerify(driver->securityManager, def) < 0)
          goto cleanup;

-    if ((def->nets != NULL) && !(cfg->have_netns)) {
-        virReportError(VIR_ERR_OPERATION_INVALID,
-                       "%s", _("System lacks NETNS support"));
-        goto cleanup;
-    }
-
      if (!(vm = virDomainObjListAdd(driver->domains, &def,
                                     driver->xmlopt,
                                     0, &oldDef)))
@@ -974,12 +968,6 @@ static int lxcDomainCreateWithFiles(virDomainPtr
dom,
      if (virDomainCreateWithFilesEnsureACL(dom->conn, vm->def) < 0)
          goto cleanup;

-    if ((vm->def->nets != NULL) && !(cfg->have_netns)) {
-        virReportError(VIR_ERR_OPERATION_INVALID,
-                       "%s", _("System lacks NETNS support"));
-        goto cleanup;
-    }
-
      if (virDomainObjBeginJob(vm, VIR_JOB_MODIFY) < 0)
          goto cleanup;

@@ -1088,13 +1076,6 @@ lxcDomainCreateXMLWithFiles(virConnectPtr conn,
      if (virSecurityManagerVerify(driver->securityManager, def) < 0)
          goto cleanup;

-    if ((def->nets != NULL) && !(cfg->have_netns)) {
-        virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
-                       "%s", _("System lacks NETNS support"));
-        goto cleanup;
-    }
-
-
      if (!(vm = virDomainObjListAdd(driver->domains, &def,
                                     driver->xmlopt,
                                     VIR_DOMAIN_OBJ_LIST_ADD_LIVE |
@@ -1386,22 +1367,6 @@ lxcDomainDestroy(virDomainPtr dom)
      return lxcDomainDestroyFlags(dom, 0);
  }

Control: tags -1 fixed-upstream pending

Leigh's patch has been accepted upstream:

  commit dd217cd9382cb7d67b26c5b3b4be07e5ce88ef86
  Author: Leigh Brown <leigh@solinno.co.uk>
  Date:   Tue Dec 3 16:02:08 2024 +0000

    lxc: remove no longer working netns check

    Since iproute2 v6.12.0, the command "ip link set lo netns -1" can
    no longer be used to check for netns support, as it now validates
    PIDs are not less than zero.

    Since every kernel we care about has the support, just remove the
    check.

    Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
    Signed-off-by: Leigh Brown <leigh@solinno.co.uk>

https://gitlab.com/libvirt/libvirt/-/commit/dd217cd9382cb7d67b26c5b3b4be07e5ce88ef86

It will be included in the upcoming upstream release, scheduled for
January 15. The Debian update will happen shortly after that.