[f18-branch/master] return to using lokkit for firewall setup (#885807)

[Brian C. Lane]

From: "Brian C. Lane"

firewalld has some issues, especially with minimal installs and dragging
in a bunch of X dependencies.

This returns to using lokkit for firewall. The differences from before are:
 - require lokkit instead of system-config-firewall-base so that maybe
   something else could provide lokkit with the same cmdline args.
 - don't use -f which would override the selinux setting which we are
   still setting directly.
---
 anaconda.spec.in        |  3 +--
 pyanaconda/install.py   |  2 +-
 pyanaconda/kickstart.py | 24 ++++++++++++++++--------
 3 files changed, 18 insertions(+), 11 deletions(-)

diff --git a/anaconda.spec.in b/anaconda.spec.in
index 9637c6f..a665b59 100644
--- a/anaconda.spec.in
+++ b/anaconda.spec.in
@@ -43,7 +43,6 @@ BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 %define sckeyboardver 1.3.1
 %define libblkidver 2.17.1-1
 %define fcoeutilsver 1.0.12-3.20100323git
-%define firewalldver 0.2.9-1
 %define pythonurlgrabberver 3.9.1-5
 %define utillinuxver 2.15.1
 %define syslinuxver 3.73
@@ -121,7 +120,7 @@ Requires: dmidecode
 Requires: python-pyblock >= %{pythonpyblockver}
 Requires: libuser-python
 Requires: authconfig
-Requires: firewalld >= %{firewalldver}
+Requires: lokkit
 Requires: cryptsetup-luks
 Requires: python-cryptsetup >= %{pythoncryptsetupver}
 Requires: mdadm
diff --git a/pyanaconda/install.py b/pyanaconda/install.py
index 6754a0a..54defc9 100644
--- a/pyanaconda/install.py
+++ b/pyanaconda/install.py
@@ -120,7 +120,7 @@ def doInstall(storage, payload, ksdata, instClass):
     # anaconda requires storage packages in order to make sure the target
     # system is bootable and configurable, and some other packages in order
     # to finish setting up the system.
-    packages = storage.packages + ["authconfig", "firewalld"]
+    packages = storage.packages + ["authconfig", "lokkit"]
     payload.preInstall(packages=packages, groups=payload.languageGroups(ksdata.lang.lang))
     payload.install()

diff --git a/pyanaconda/kickstart.py b/pyanaconda/kickstart.py
index 1ec294a..6ef1e77 100644
--- a/pyanaconda/kickstart.py
+++ b/pyanaconda/kickstart.py
@@ -457,7 +457,7 @@ class Fcoe(commands.fcoe.F13_Fcoe):

class Firewall(commands.firewall.F14_Firewall):
     def execute(self, storage, ksdata, instClass):
-        args = []
+        args = ["--quiet", "--nostart"]
         # enabled is None if neither --enable or --disable is passed
         # default to enabled if nothing has been set.
         if self.enabled == False:
@@ -477,14 +477,22 @@ class Firewall(commands.firewall.F14_Firewall):
         for service in self.services:
             args += [ "--service=%s" % (service,) ]

-        cmd = "/usr/bin/firewall-offline-cmd"
-        if not os.path.exists(ROOT_PATH+cmd):
-            msg = _("%s is missing. Cannot setup firewall.") % (cmd,)
-            raise KickstartError(msg)
+        cmd = "/usr/sbin/lokkit"
+        try:
+            if not os.path.exists(ROOT_PATH + "/etc/sysconfig/iptables"):
+                iutil.execWithRedirect(cmd, args,
+                                       stdout="/dev/tty5", stderr="/dev/tty5",
+                                       root=ROOT_PATH)
+            else:
+                log.error("/etc/sysconfig/iptables exists, skipping lokkit. "
+                          "Would have run %s", args)
+        except (RuntimeError, OSError) as msg:
+            log.error ("lokkit run failed: %s", msg)
         else:
-            iutil.execWithRedirect(cmd, args,
-                                   stdout="/dev/tty5", stderr="/dev/tty5",
-                                   root=ROOT_PATH)
+            with open(ROOT_PATH + "/etc/sysconfig/system-config-firewall", "w") as f:
+                f.write("# system-config-firewall config written out by anaconda\n\n")
+                for arg in args[2:]:
+                    f.write("%s\n" %(arg,))

class Firstboot(commands.firstboot.FC3_Firstboot):
     def execute(self, *args):

[Bill Nottingham]

Brian C. Lane ([e-mail]) said:
> From: "Brian C. Lane"
>
> firewalld has some issues, especially with minimal installs and dragging
> in a bunch of X dependencies.
>
> This returns to using lokkit for firewall. The differences from before are:
> require lokkit instead of system-config-firewall-base so that maybe
> something else could provide lokkit with the same cmdline args.
> don't use -f which would override the selinux setting which we are
> still setting directly.

This means that it writes a firewall that won't actually do anything on
boot (the iptables service isn't run/enabled by default, unless other
changes are made.) I don't think that's better...

Bill

[Brian C. Lane]

On Tue, Dec 11, 2012 at 01:53:13PM -0500, Bill Nottingham wrote:
> Brian C. Lane ([e-mail]) said:
> > From: "Brian C. Lane"
> >
> > firewalld has some issues, especially with minimal installs and dragging
> > in a bunch of X dependencies.
> >
> > This returns to using lokkit for firewall. The differences from before are:
> > require lokkit instead of system-config-firewall-base so that maybe
> > something else could provide lokkit with the same cmdline args.
> > don't use -f which would override the selinux setting which we are
> > still setting directly.
>
> This means that it writes a firewall that won't actually do anything on
> boot (the iptables service isn't run/enabled by default, unless other
> changes are made.) I don't think that's better...

Right, this is only one piece of the puzzle. It looks like we're not
going to make this change, it is too much for this late date and
firewalld is going to sort things out itself. So I'll drop this patch
into the bug and we can revisit at a later time if needed.