Page MenuHomeVyOS Platform

services using VRF generates the error "Failed to load BPF prog: 'Operation not permitted'" when the system boots.
Closed, ResolvedPublicBUG

Description

The service which is running under vrf, generates the error

Failed to load BPF prog: 'Operation not permitted'

This error does not reproduce in GNS3 but it reproduces in VMWare
In some cases, the service does not run after restarting the service.

For example:
Configuration:

set interfaces ethernet eth1 address '2001:ed01::1/64'
set interfaces ethernet eth1 vrf 'VRFA'
set service snmp community test authorization 'ro'
set service snmp listen-address 2001:ed01::1
set service snmp vrf 'VRFA'
set service ssh port '22'
set vrf name VRFA table '200'

After the system boot, there are logs

Sep 27 19:49:50 vyos systemd[1]: Stopped Simple Network Management Protocol (SNMP) Daemon..
Sep 27 19:49:50 vyos systemd[1]: Starting Simple Network Management Protocol (SNMP) Daemon....
Sep 27 19:49:50 vyos  systemd[1]: Started Simple Network Management Protocol (SNMP) Daemon..
Sep 27 19:49:50 vyos ip[43076]: Failed to load BPF prog: 'Operation not permitted'
Sep 27 19:49:50 vyos systemd[1]: snmpd.service: Main process exited, code=exited, status=255/EXCEPTION
Sep 27 19:49:50 vyos systemd[1]: snmpd.service: Failed with result 'exit-code'.
vyos@vyos:/home/admin# systemctl status snmpd
● snmpd.service - Simple Network Management Protocol (SNMP) Daemon.
   Loaded: loaded (/lib/systemd/system/snmpd.service; disabled; vendor preset: enabled)
  Drop-In: /etc/systemd/system/snmpd.service.d
           └─override.conf
   Active: activating (auto-restart) (Result: exit-code) since Wed 2023-09-27 19:48:58 UTC; 6s ago
  Process: 42975 ExecStartPre=/bin/mkdir -p /var/run/agentx (code=exited, status=0/SUCCESS)
  Process: 42976 ExecStart=/usr/sbin/ip vrf exec root /usr/sbin/snmpd -LS0-5d -Lf /dev/null -u Debian-snmp -g Debian-snmp -I
 Main PID: 42976 (code=exited, status=255/EXCEPTION)

Details

Difficulty level
Unknown (require assessment)
Version
VyOS 1.3.4
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Perfectly compatible
Issue type
Bug (incorrect behavior)