From: "Brian C. Lane" bcl@redhat.com
firewalld has some issues, especially with minimal installs and dragging in a bunch of X dependencies.
This returns to using lokkit for firewall. The differences from before are: - require lokkit instead of system-config-firewall-base so that maybe something else could provide lokkit with the same cmdline args. - don't use -f which would override the selinux setting which we are still setting directly. --- anaconda.spec.in | 3 +-- pyanaconda/install.py | 2 +- pyanaconda/kickstart.py | 24 ++++++++++++++++-------- 3 files changed, 18 insertions(+), 11 deletions(-)
diff --git a/anaconda.spec.in b/anaconda.spec.in index 9637c6f..a665b59 100644 --- a/anaconda.spec.in +++ b/anaconda.spec.in @@ -43,7 +43,6 @@ BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) %define sckeyboardver 1.3.1 %define libblkidver 2.17.1-1 %define fcoeutilsver 1.0.12-3.20100323git -%define firewalldver 0.2.9-1 %define pythonurlgrabberver 3.9.1-5 %define utillinuxver 2.15.1 %define syslinuxver 3.73 @@ -121,7 +120,7 @@ Requires: dmidecode Requires: python-pyblock >= %{pythonpyblockver} Requires: libuser-python Requires: authconfig -Requires: firewalld >= %{firewalldver} +Requires: lokkit Requires: cryptsetup-luks Requires: python-cryptsetup >= %{pythoncryptsetupver} Requires: mdadm diff --git a/pyanaconda/install.py b/pyanaconda/install.py index 6754a0a..54defc9 100644 --- a/pyanaconda/install.py +++ b/pyanaconda/install.py @@ -120,7 +120,7 @@ def doInstall(storage, payload, ksdata, instClass): # anaconda requires storage packages in order to make sure the target # system is bootable and configurable, and some other packages in order # to finish setting up the system. - packages = storage.packages + ["authconfig", "firewalld"] + packages = storage.packages + ["authconfig", "lokkit"] payload.preInstall(packages=packages, groups=payload.languageGroups(ksdata.lang.lang)) payload.install()
diff --git a/pyanaconda/kickstart.py b/pyanaconda/kickstart.py index 1ec294a..6ef1e77 100644 --- a/pyanaconda/kickstart.py +++ b/pyanaconda/kickstart.py @@ -457,7 +457,7 @@ class Fcoe(commands.fcoe.F13_Fcoe):
class Firewall(commands.firewall.F14_Firewall): def execute(self, storage, ksdata, instClass): - args = [] + args = ["--quiet", "--nostart"] # enabled is None if neither --enable or --disable is passed # default to enabled if nothing has been set. if self.enabled == False: @@ -477,14 +477,22 @@ class Firewall(commands.firewall.F14_Firewall): for service in self.services: args += [ "--service=%s" % (service,) ]
- cmd = "/usr/bin/firewall-offline-cmd" - if not os.path.exists(ROOT_PATH+cmd): - msg = _("%s is missing. Cannot setup firewall.") % (cmd,) - raise KickstartError(msg) + cmd = "/usr/sbin/lokkit" + try: + if not os.path.exists(ROOT_PATH + "/etc/sysconfig/iptables"): + iutil.execWithRedirect(cmd, args, + stdout="/dev/tty5", stderr="/dev/tty5", + root=ROOT_PATH) + else: + log.error("/etc/sysconfig/iptables exists, skipping lokkit. " + "Would have run %s", args) + except (RuntimeError, OSError) as msg: + log.error ("lokkit run failed: %s", msg) else: - iutil.execWithRedirect(cmd, args, - stdout="/dev/tty5", stderr="/dev/tty5", - root=ROOT_PATH) + with open(ROOT_PATH + "/etc/sysconfig/system-config-firewall", "w") as f: + f.write("# system-config-firewall config written out by anaconda\n\n") + for arg in args[2:]: + f.write("%s\n" %(arg,))
class Firstboot(commands.firstboot.FC3_Firstboot): def execute(self, *args):