From a0c34d64a53e0eaa42ea8dbe433bae96c347ddc1 Mon Sep 17 00:00:00 2001
From: Paul Holzinger <pholzing@redhat.com>
Date: Wed, 23 Feb 2022 15:34:41 +0100
Subject: [PATCH] Load ip_tables modules at boot

Rootless users cannot load the ip_tables module, in fedora 36 this
module is no longer loaded by default so we have to add it manually.
This is needed because rootless network setup tries to use iptables
and if iptables-legacy is used instead of iptables-nft it will fail.

To provide a better user experience we will load the module at boot.

Note that this is not needed for RHEL because iptables-legacy is not
supported on RHEL 8 and newer.

[NO NEW TESTS NEEDED]

Fixes #12661

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
---
 Makefile                                    | 6 ++++++
 contrib/modules-load.d/podman-iptables.conf | 5 +++++
 podman.spec.rpkg                            | 6 ++++++
 3 files changed, 17 insertions(+)
 create mode 100644 contrib/modules-load.d/podman-iptables.conf

diff --git a/Makefile b/Makefile
index 0a5389ce94..cb230d8e9f 100644
--- a/Makefile
+++ b/Makefile
@@ -44,6 +44,7 @@ MANDIR ?= ${PREFIX}/share/man
 SHAREDIR_CONTAINERS ?= ${PREFIX}/share/containers
 ETCDIR ?= ${PREFIX}/etc
 TMPFILESDIR ?= ${PREFIX}/lib/tmpfiles.d
+MODULESLOADDIR ?= ${PREFIX}/lib/modules-load.d
 SYSTEMDDIR ?= ${PREFIX}/lib/systemd/system
 USERSYSTEMDDIR ?= ${PREFIX}/lib/systemd/user
 REMOTETAGS ?= remote exclude_graphdriver_btrfs btrfs_noversion exclude_graphdriver_devicemapper containers_image_openpgp
@@ -779,6 +780,11 @@ install.bin:
 	install ${SELINUXOPT} -m 755 -d ${DESTDIR}${TMPFILESDIR}
 	install ${SELINUXOPT} -m 644 contrib/tmpfile/podman.conf ${DESTDIR}${TMPFILESDIR}/podman.conf
 
+.PHONY: install.modules-load
+install.modules-load: # This should only be used by distros which might use iptables-legacy, this is not needed on RHEL
+	install ${SELINUXOPT} -m 755 -d ${DESTDIR}${MODULESLOADDIR}
+	install ${SELINUXOPT} -m 644 contrib/modules-load.d/podman-iptables.conf ${DESTDIR}${MODULESLOADDIR}/podman-iptables.conf
+
 .PHONY: install.man
 install.man:
 	install ${SELINUXOPT} -d -m 755 $(DESTDIR)$(MANDIR)/man1
diff --git a/contrib/modules-load.d/podman-iptables.conf b/contrib/modules-load.d/podman-iptables.conf
new file mode 100644
index 0000000000..001ef8af84
--- /dev/null
+++ b/contrib/modules-load.d/podman-iptables.conf
@@ -0,0 +1,5 @@
+# On fedora 36 ip_tables is no longer auto loaded and rootless user have no permsissions to load it.
+# When we have actual nftables support in the future we might want to revisit this.
+# If you use iptables-nft this is not needed.
+ip_tables
+ip6_tables
diff --git a/podman.spec.rpkg b/podman.spec.rpkg
index 4068b3a81c..a6f66ce98e 100644
--- a/podman.spec.rpkg
+++ b/podman.spec.rpkg
@@ -203,6 +203,9 @@ PODMAN_VERSION=%{version} %{__make} DESTDIR=%{buildroot} PREFIX=%{_prefix} ETCDI
         install.docker \
         install.docker-docs \
         install.remote \
+%if 0%{?fedora} >= 36
+        install.modules-load
+%endif
 
 install -d -p %{buildroot}/%{_datadir}/%{name}/test/system
 cp -pav test/system %{buildroot}/%{_datadir}/%{name}/test/
@@ -239,6 +242,9 @@ done
 %{_userunitdir}/%{name}.socket
 %{_userunitdir}/%{name}-restart.service
 %{_usr}/lib/tmpfiles.d/%{name}.conf
+%if 0%{?fedora} >= 36
+    %{_usr}/lib/modules-load.d/%{name}-iptables.conf
+%endif
 
 %files docker
 %{_bindir}/docker