[Fedora-livecd-list] Is it possible to configure the firewall in %post?

[Mads Kiilerich]

On 06/30/2011 03:39 AM, Aaron Cohen wrote:
> I'm trying to configure a firewall for my livecd. Currently, I'm
> calling lokkit in %post, though I've also tried using iptables and
> iptables-save. Unfortunately, no matter what I try, my configuration
> seems to be discarded.
>
> As far as I can tell, "lokkit" is run after the post scripts, to
> enable or disable selinux. This seems to recreate
> /etc/sysconfig/iptables and move my changes to
> /etc/sysconfig/iptables.old.
>
> My understanding is that "lokkit --selinux=enforcing" is not supposed
> to do anything other than enable selinux, but it definitely seems to
> also discard firewall configuration in my testing.
>
> Is this intended?

If I remember correctly my preferred workaround is to avoid including 
system-config-firewall* in the live image. It is a dependency from 
anaconda, so you might have to break something there.

SE can be enabled "manually" with "echo SELINUX=enabled > 
/etc/selinux/config", but I think that is the default anyway.

/Mads