running firewall-cmd from a detached script

[Nikos Mavrogiannopoulos]

Hello,
 I'm trying to run firewall-cmd (0.3.9 on RHEL7) under a script that is
run by a vpn server (as root) on a client connect. The command is
something like the following:
#!/bin/sh
firewall-cmd --zone=internal --add-interface=$DEVICE

However, that script seems to hang and firewall-cmd never returns.
Running the same command from a terminal or using screen succeeds. Is
there some requirement of firewall-cmd to run from a terminal?

Any ideas on how to debug?

The hanged process on gdb seems to block at:
#0  0x00007f1dd5a76df0 in __poll_nocancel () from /lib64/libc.so.6
#1  0x00007f1dcb19d780 in socket_do_iteration ()
from /lib64/libdbus-1.so.3
#2  0x00007f1dcb19c5ff in _dbus_transport_do_iteration ()
   from /lib64/libdbus-1.so.3
#3  0x00007f1dcb185d7c in _dbus_connection_do_iteration_unlocked ()
   from /lib64/libdbus-1.so.3
#4  0x00007f1dcb18687c in _dbus_connection_block_pending_call ()
   from /lib64/libdbus-1.so.3
#5  0x00007f1dcb186d3a in dbus_connection_send_with_reply_and_block ()
   from /lib64/libdbus-1.so.3
#6  0x00007f1dcb3ca0df in Connection_send_message_with_reply_and_block
()
   from /usr/lib64/python2.7/site-packages/_dbus_bindings.so
#7  0x00007f1dd6751b94 in PyEval_EvalFrameEx ()
from /lib64/libpython2.7.so.1.0
#8  0x00007f1dd67531ad in PyEval_EvalCodeEx ()
from /lib64/libpython2.7.so.1.0

[Jiri Popelka]

On 08/01/2014 04:21 PM, Nikos Mavrogiannopoulos wrote:
> However, that script seems to hang and firewall-cmd never returns.

I just tried to run this script on RHEL7:
https://git.fedorahosted.org/cgit/firewalld.git/tree/src/tests/firewall-cmd_...
which also runs firewall-cmd and I haven't seen such problems.
> Any ideas on how to debug?

nope, sorry.

--
Jiri

[Thomas Woerner]

Hello,

On 08/01/2014 04:21 PM, Nikos Mavrogiannopoulos wrote:
> Hello,
>   I'm trying to run firewall-cmd (0.3.9 on RHEL7) under a script that is
> run by a vpn server (as root) on a client connect. The command is
> something like the following:
> #!/bin/sh
> firewall-cmd --zone=internal --add-interface=$DEVICE
>
> However, that script seems to hang and firewall-cmd never returns.
> Running the same command from a terminal or using screen succeeds. Is
> there some requirement of firewall-cmd to run from a terminal?

please verify which user and group is used for this script. Are there 
AVC messages or any other error message in the logs at this time?
> Any ideas on how to debug?
>
> The hanged process on gdb seems to block at:
> #0  0x00007f1dd5a76df0 in __poll_nocancel () from /lib64/libc.so.6
> #1  0x00007f1dcb19d780 in socket_do_iteration ()
> from /lib64/libdbus-1.so.3
> #2  0x00007f1dcb19c5ff in _dbus_transport_do_iteration ()
>     from /lib64/libdbus-1.so.3
> #3  0x00007f1dcb185d7c in _dbus_connection_do_iteration_unlocked ()
>     from /lib64/libdbus-1.so.3
> #4  0x00007f1dcb18687c in _dbus_connection_block_pending_call ()
>     from /lib64/libdbus-1.so.3
> #5  0x00007f1dcb186d3a in dbus_connection_send_with_reply_and_block ()
>     from /lib64/libdbus-1.so.3
> #6  0x00007f1dcb3ca0df in Connection_send_message_with_reply_and_block
> ()
>     from /usr/lib64/python2.7/site-packages/_dbus_bindings.so
> #7  0x00007f1dd6751b94 in PyEval_EvalFrameEx ()
> from /lib64/libpython2.7.so.1.0
> #8  0x00007f1dd67531ad in PyEval_EvalCodeEx ()
> from /lib64/libpython2.7.so.1.0

I have not seen this error before.

Regards,
Thomas

[Nikos Mavrogiannopoulos]

On Mon, 2014-08-04 at 14:52 +0200, Thomas Woerner wrote:
> > Any ideas on how to debug?
> > The hanged process on gdb seems to block at:
> > #0  0x00007f1dd5a76df0 in __poll_nocancel () from /lib64/libc.so.6
> > #1  0x00007f1dcb19d780 in socket_do_iteration ()
> > from /lib64/libdbus-1.so.3
> > #2  0x00007f1dcb19c5ff in _dbus_transport_do_iteration ()
> >     from /lib64/libdbus-1.so.3
> > #3  0x00007f1dcb185d7c in _dbus_connection_do_iteration_unlocked ()
> >     from /lib64/libdbus-1.so.3
> > #4  0x00007f1dcb18687c in _dbus_connection_block_pending_call ()
> >     from /lib64/libdbus-1.so.3
> > #5  0x00007f1dcb186d3a in dbus_connection_send_with_reply_and_block ()
> >     from /lib64/libdbus-1.so.3
> > #6  0x00007f1dcb3ca0df in Connection_send_message_with_reply_and_block
> > ()
> >     from /usr/lib64/python2.7/site-packages/_dbus_bindings.so
> > #7  0x00007f1dd6751b94 in PyEval_EvalFrameEx ()
> > from /lib64/libpython2.7.so.1.0
> > #8  0x00007f1dd67531ad in PyEval_EvalCodeEx ()
> > from /lib64/libpython2.7.so.1.0
>
> I have not seen this error before.

Problem solved. It was the inherited signal mask from the executing
process that caused the issue.

regards,
Nikos