Fedora-11 Status

[Kedar Sovani]

Since the last announcement of F-11 packages, a large number of packages have further been built. There currently are above 9000 rpms in the Fedora-11 repositories. Our effort has been to make available the following package groups:

Base
Core
Web-server
Gnome Desktop
Xfce desktop
Development Tools
X server
Web development
Admin Tools
System Tools
Java

The Fedora-11 updates for a large set of packages are also now available.

For Fedora-12, we would like to start tracking packages preferably when all the shared lib .so version updates are settled for f12 (thus avoiding any additional rebuild cycles at our end). Most likely this will happen by the Fedora-12 Beta Freeze date (29 Sept, in 3/4 days).

Kedar.

[Steve Grubb]

On Thursday 24 September 2009 08:03:22 am Kedar Sovani wrote:
> For Fedora-12, we would like to start tracking packages preferably when all
>  the shared lib .so version updates are settled for f12 (thus avoiding any
>  additional rebuild cycles at our end). Most likely this will happen by the
>  Fedora-12 Beta Freeze date (29 Sept, in 3/4 days).

I was wondering if in the next kernel build if netfilter/iptables can be 
enabled?

-Steve

[Kedar Sovani]

> -----Original Message-----
> From: [e-mail] [mailto:fedora-arm-
> [e-mail]] On Behalf Of Steve Grubb
> Sent: 06 October 2009 01:21
> To: [e-mail]
> Subject: Re: [fedora-arm] Fedora-11 Status
>
> On Thursday 24 September 2009 08:03:22 am Kedar Sovani wrote:
> > For Fedora-12, we would like to start tracking packages
>
> preferably when all
> > the shared lib .so version updates are settled for f12 (thus
>
> avoiding any
> > additional rebuild cycles at our end). Most likely this will
>
> happen by the
> > Fedora-12 Beta Freeze date (29 Sept, in 3/4 days).
>
> I was wondering if in the next kernel build if
> netfilter/iptables can be
> enabled?

We do not disable it.

The kernel build just picks the default fedora kernel configuration and merges the arch-specific ("config-arm" in our case) exception file. This file hasn't disabled iptables:
http://cvs.fedoraproject.org/viewvc/rpms/kernel/devel/config-arm?revision=1....
> -Steve

Kedar.

[Steve Grubb]

On Tuesday 06 October 2009 04:45:33 am you wrote:
> > I was wondering if in the next kernel build if
> > netfilter/iptables can be
> > enabled?
>
> We do not disable it.
>
> The kernel build just picks the default fedora kernel configuration and
>  merges the arch-specific ("config-arm" in our case) exception file. This
>  file hasn't disabled iptables:
>  http://cvs.fedoraproject.org/viewvc/rpms/kernel/devel/config-arm?revision=
> 1.5

OK, I assumed it was not working because:

iptables-restore /etc/sysconfig/iptables
FATAL: Could not load /lib/modules/2.6.30-00000-v2.6.30/modules.dep: No such 
file or directory
iptables-restore v1.4.3.1: iptables-restore: unable to initialize table 
'filter'

Error occurred at line: 3
Try `iptables-restore -h' or 'iptables-restore --help' for more information.

I traced through the initscript and decided to just try iptables-restore by 
itself. The initscripts really want a loadable module. Anyways, based on your 
comment, I tried setting --modprobe=/bin/true  to trick it. No luck. It 
doesn't complain about not being able to load the module anymore, but still 
fails at line 3. The firewall rules are simple:

# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

Running strace, it dies like this:

socket(PF_INET, SOCK_RAW, IPPROTO_RAW)  = 4
getsockopt(4, SOL_IP, 0x40 /* IP_??? */, 0xbeda7ee8, 0xbeda7ee0) = -1 
ENOPROTOOPT (Protocol not available)
close(4)                                = 0

-Steve

[Kedar Sovani]

> -----Original Message-----
> From: Steve Grubb [mailto:[e-mail]]
> Sent: 22 October 2009 21:39
> To: Kedar Sovani; [e-mail]
> Subject: Re: [fedora-arm] Fedora-11 Status
>
> On Tuesday 06 October 2009 04:45:33 am you wrote:
> > > I was wondering if in the next kernel build if
> > > netfilter/iptables can be
> > > enabled?
> >
> > We do not disable it.
> >
> > The kernel build just picks the default fedora kernel
>
> configuration and
> > merges the arch-specific ("config-arm" in our case)
>
> exception file. This
> > file hasn't disabled iptables:
>
> http://cvs.fedoraproject.org/viewvc/rpms/kernel/devel/config-
> arm?revision=
> > 1.5
>
> OK, I assumed it was not working because:
>
> iptables-restore /etc/sysconfig/iptables
> FATAL: Could not load /lib/modules/2.6.30-00000-
> v2.6.30/modules.dep: No such
> file or directory
> iptables-restore v1.4.3.1: iptables-restore: unable to
> initialize table
> 'filter'
>
> Error occurred at line: 3
> Try `iptables-restore -h' or 'iptables-restore --help' for more
> information.

Have you installed all the kernel modules for your kernel at install_root/lib/modules/<kernel_version> ?

May be it does not find the kernel modules to load?

Kedar.
> I traced through the initscript and decided to just try
> iptables-restore by
> itself. The initscripts really want a loadable module. Anyways,
> based on your
> comment, I tried setting --modprobe=/bin/true  to trick it. No
> luck. It
> doesn't complain about not being able to load the module
> anymore, but still
> fails at line 3. The firewall rules are simple:
>
> # Firewall configuration written by system-config-firewall
> # Manual customization of this file is not recommended.
> *filter
> :INPUT ACCEPT [0:0]
> :FORWARD ACCEPT [0:0]
> :OUTPUT ACCEPT [0:0]
> -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
> -A INPUT -p icmp -j ACCEPT
> -A INPUT -i lo -j ACCEPT
> -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j
> ACCEPT
> -A INPUT -j REJECT --reject-with icmp-host-prohibited
> -A FORWARD -j REJECT --reject-with icmp-host-prohibited
> COMMIT
>
> Running strace, it dies like this:
>
> socket(PF_INET, SOCK_RAW, IPPROTO_RAW)  = 4
> getsockopt(4, SOL_IP, 0x40 /* IP_??? */, 0xbeda7ee8,
> 0xbeda7ee0) = -1
> ENOPROTOOPT (Protocol not available)
> close(4)                                = 0
>
> -Steve

[Steve Grubb]

On Thursday 22 October 2009 12:25:06 pm Kedar Sovani wrote:
> > Error occurred at line: 3
> > Try `iptables-restore -h' or 'iptables-restore --help' for more
> > information.
>
> Have you installed all the kernel modules for your kernel at
>  install_root/lib/modules/<kernel_version> ?
>
> May be it does not find the kernel modules to load?

That's a fair question.

#ls /lib/modules/
#

Its empty. I am using the rootfs:
http://ftp.linux.org.uk/pub/linux/arm/fedora/rootfs/rootfs-f11.tar.bz2

and putting
http://ftp.linux.org.uk/pub/linux/arm/fedora/platforms/sheevaplug/uImage-2.6...

inside it. Checking that website doesn't find any modules. Is
there a package that has these modules?

Thanks,
-Steve

[Kedar Sovani]

> -----Original Message-----
> From: Steve Grubb [mailto:[e-mail]]
> Sent: 22 October 2009 22:06
> To: Kedar Sovani
> Cc: [e-mail]
> Subject: Re: [fedora-arm] Fedora-11 Status
>
> On Thursday 22 October 2009 12:25:06 pm Kedar Sovani wrote:
> > > Error occurred at line: 3
> > > Try `iptables-restore -h' or 'iptables-restore --help' for
>
> more
> > > information.
> >
> > Have you installed all the kernel modules for your kernel at
> >  install_root/lib/modules/<kernel_version> ?
> >
> > May be it does not find the kernel modules to load?
>
> That's a fair question.
>
> #ls /lib/modules/
> #
>
> Its empty. I am using the rootfs:
> http://ftp.linux.org.uk/pub/linux/arm/fedora/rootfs/rootfs-
> f11.tar.bz2
>
> and putting
> http://ftp.linux.org.uk/pub/linux/arm/fedora/platforms/sheevapl
> ug/uImage-2.6.30-sheevaplug
>
> inside it. Checking that website doesn't find any modules. Is
> there a package that has these modules?

There is no package that has the modules. A tarball of the same should have been uploaded there along with the kernel. Sigh! 
I'll get to it sometime later.

You'll have to build the kernel and modules in the meanwhile.
> Thanks,
> -Steve

Kedar.