networkd: drop CAP_SYS_MODULE

Rely on modules being built-in or autoloaded on-demand.

As networkd is a network facing service, we want to limits its capabilities,
as much as possible. Also, we may not have CAP_SYS_MODULE in a container,
and we want networkd to work the same there.

Module autoloading does not always work, but should be fixed by the kernel
patch f98f89a0104454f35a: 'net: tunnels - enable module autoloading', which
is currently in net-next and which people may consider backporting if they
want tunneling support without compiling in the modules.

Early adopters may also use a module-load.d snippet and order
systemd-modules-load.service before networkd to force the module
loading of tunneling modules.

This sholud fix the various build issues people have reported.

src/network/networkd-manager.c

@@ -21,7 +21,6 @@
 
 #include <sys/socket.h>
 #include <linux/if.h>
-#include <libkmod.h>
 
 #include "conf-parser.h"
 #include "path-util.h"
@@ -120,10 +119,6 @@ int manager_new(Manager **ret) {
                         return -ENOMEM;
         }
 
-        m->kmod_ctx = kmod_new(NULL, NULL);
-        if (!m->kmod_ctx)
-                return -ENOMEM;
-
         m->links = hashmap_new(uint64_hash_func, uint64_compare_func);
         if (!m->links)
                 return -ENOMEM;
@@ -150,7 +145,6 @@ void manager_free(Manager *m) {
 
         free(m->state_file);
 
-        kmod_unref(m->kmod_ctx);
         udev_monitor_unref(m->udev_monitor);
         udev_unref(m->udev);
         sd_bus_unref(m->bus);

src/network/networkd-tunnel.c

@@ -24,7 +24,6 @@
 #include <net/if.h>
 #include <linux/ip.h>
 #include <linux/if_tunnel.h>
-#include <libkmod.h>
 
 #include "sd-rtnl.h"
 #include "networkd.h"
@@ -443,27 +442,6 @@ int netdev_create_tunnel(Link *link, sd_rtnl_message_handler_t callback) {
         assert(netdev->ifname);
         assert(netdev->manager);
         assert(netdev->manager->rtnl);
-        assert(netdev->manager->kmod_ctx);
-
-        /* Load kernel module first */
-        switch(netdev->kind) {
-        case NETDEV_KIND_IPIP:
-        case NETDEV_KIND_GRE:
-        case NETDEV_KIND_SIT:
-                r = load_module(netdev->manager->kmod_ctx,
-                                netdev_kind_to_string(netdev->kind));
-                if (r < 0) {
-                        log_error_netdev(netdev,
-                                         "Could not load Kernel module: %s . Ignoring",
-                                         netdev_kind_to_string(netdev->kind));
-                        return r;
-                }
-                break;
-        case NETDEV_KIND_VTI:
-                break;
-        default:
-                return -ENOTSUP;
-        }
 
         r = sd_rtnl_message_new_link(netdev->manager->rtnl, &m, RTM_NEWLINK, 0);
         if (r < 0) {

src/network/networkd.c

@@ -71,8 +71,7 @@ int main(int argc, char *argv[]) {
                             (1ULL << CAP_NET_ADMIN) |
                             (1ULL << CAP_NET_BIND_SERVICE) |
                             (1ULL << CAP_NET_BROADCAST) |
-                            (1ULL << CAP_NET_RAW) |
-                            (1ULL << CAP_SYS_MODULE));
+                            (1ULL << CAP_NET_RAW));
         if (r < 0)
                 goto out;
 

src/network/networkd.h

@@ -275,7 +275,6 @@ struct Manager {
         LIST_HEAD(Network, networks);
 
         usec_t network_dirs_ts_usec;
-        struct kmod_ctx *kmod_ctx;
 };
 
 extern const char* const network_dirs[];