On CIS hardened systems lldp can't disable i40e lldp PermissionError: [Errno 1] Operation not permitted /sys/kernel/debug/i40e/XXXXXX/command

[dparv]

2022-08-22 13:37:33 WARNING unit.lldpd/156.config-changed logger.go:60 Traceback (most recent call last):
2022-08-22 13:37:33 WARNING unit.lldpd/156.config-changed logger.go:60 File "/var/lib/juju/agents/unit-lldpd-156/charm/hooks/config-changed", line 93, in
2022-08-22 13:37:33 WARNING unit.lldpd/156.config-changed logger.go:60 hooks.execute(sys.argv)
2022-08-22 13:37:33 WARNING unit.lldpd/156.config-changed logger.go:60 File "/var/lib/juju/agents/unit-lldpd-156/charm/charmhelpers/core/hookenv.py", line 934, in execute
2022-08-22 13:37:33 WARNING unit.lldpd/156.config-changed logger.go:60 self._hookshook_name
2022-08-22 13:37:33 WARNING unit.lldpd/156.config-changed logger.go:60 File "/var/lib/juju/agents/unit-lldpd-156/charm/hooks/config-changed", line 51, in config_changed
2022-08-22 13:37:33 WARNING unit.lldpd/156.config-changed logger.go:60 disable_i40e_lldp()
2022-08-22 13:37:33 WARNING unit.lldpd/156.config-changed logger.go:60 File "/var/lib/juju/agents/unit-lldpd-156/charm/hooks/config-changed", line 78, in disable_i40e_lldp
2022-08-22 13:37:33 WARNING unit.lldpd/156.config-changed logger.go:60 cmd = open('%s/%s/command' % (str(path), str(nic)), 'w')
2022-08-22 13:37:33 WARNING unit.lldpd/156.config-changed logger.go:60 PermissionError: [Errno 1] Operation not permitted: '/sys/kernel/debug/i40e/0000:b0:00.1/command'

Workaround is to disable it with ethtool, but charm still in error state:

cat ifaces | xargs -I {} ethtool --set-priv-flags {} disable-fw-lldp on

[dparv]

• might not be related to CIS hardening, as this has also failed on vanilla ubuntu during MAAS commissioning with a script to disable lldp, might need to move the code to using ethtool

[MrClayPole]

Looks like if you have secureboot enabled then it blocks access to debugfs which then causes the charm to error when accessing '/sys/kernel/debug/i40e/0000:b0:00.1/command'. I believe this charm needs to be updated to use ethtool rather than using debugfs file systems

[MrClayPole]

#16

[xtrusia]

Hello @wolsen
I'm aware of that this patch is merged and there are something to clean up.
But the customer is waiting on this patched charm to be released for a long time.
Could you please check this once more?
Thanks in advance!

[wolsen]

Fix is released and available in the latest/candidate channel