[Devel] [PATCH RHEL7 COMMIT] ve/kmod: allow "nft_compat" module autoload from inside a Container

[Konstantin Khorenko]

The commit is pushed to "branch-rh7-3.10.0-1062.4.1.vz7.115.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-1062.4.1.vz7.115.6
------>
commit 8ef966606469defe67df2fffd5bbd4260b5ce188
Author: Konstantin Khorenko <khorenko at virtuozzo.com>
Date:   Thu Oct 31 15:22:34 2019 +0300

    ve/kmod: allow "nft_compat" module autoload from inside a Container
    
    A Container with CentOS 8 inside uses nft by default and
    iptables work in a legacy mode, for that "nft_compat" is
    required, so allow its autoload.
    
     [CT]# iptables -A INPUT -m tos --tos Minimize-Cost -j REJECT
         iptables v1.8.2 (nf_tables): Couldn't load match
         `tos':No such file or directory
    
    https://jira.sw.ru/browse/PSBM-98948
    
    Signed-off-by: Konstantin Khorenko <khorenko at virtuozzo.com>
    Acked-by: Andrey Ryabinin <aryabinin at virtuozzo.com>
---
 kernel/kmod.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/kmod.c b/kernel/kmod.c
index 6f0149d07bb6..26edbca07cba 100644
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -283,6 +283,7 @@ static struct {
 	{ "nf_conntrack_ipv6",	VE_NF_CONNTRACK|VE_IP_CONNTRACK },
 
 	{ "nfnetlink-subsys-10",VE_IP_IPTABLES			}, /* nf_tables */
+	{ "nfnetlink-subsys-11",VE_IP_IPTABLES			}, /* nft_compat */
 	{ "nft-set",		VE_IP_IPTABLES			},
 	{ "nft-afinfo-2",	VE_IP_IPTABLES			}, /* IPV4 */
 	{ "nft-afinfo-3",	VE_IP_IPTABLES			}, /* ARP  */