On Wed, Feb 6, 2013 at 1:34 AM, Adam Williamson <awilliam(a)redhat.com> wrote:
On Tue, 2013-02-05 at 17:20 -0500, Matthew Miller wrote:
> On Wed, Jan 30, 2013 at 12:51:49PM +0000, Jaroslav Reznik wrote:
> > This feature adds a simple configuration setting for firewalld to be able to
> > lock down configuration changes from local applications.
> > == Detailed description ==
> > Local applications are able to change the firewall configuration. With this
> > feature the administator can lock the firewall configuration and these
> > applications are not able to modify the firewall anymore.
> >
> > The lockdown feature is the first part of user and application policies for
> > firewalld and will be disabled by default.
>
> Without this feature, the available changes users can make are not limited
> in any way, right? That is, with current firewalld, any local user can
> change the firewall without additional authentication?
I'm not sure that's correct, no. When I launch firewall-config I'm asked
for auth. It's as my local user, but I think that's because my local
user is set as an admin account. I don't believe regular (non-admin)
users can modify the config. I'm willing to be wrong, though.
Looking at /usr/share/polkit-1/actions/org.fedoraproject.FirewallD1.policy
quoted below, the default seems locked down to administrators already.
Hm, so what does the feature really do?
Mirek
<action id="org.fedoraproject.FirewallD1.config">
<description>Firewall configuration</description>
<message>System policy prevents to change the firewall
configuration</message>
<defaults>
<allow_any>auth_admin</allow_any>
<allow_inactive>auth_admin</allow_inactive>
<allow_active>auth_admin_keep</allow_active>
</defaults>
</action>
<action id="org.fedoraproject.FirewallD1.direct">
<description>Firewall direct interface</description>
<message>System policy prevents to use the firewall direct
interface</message>
<defaults>
<allow_any>auth_admin</allow_any>
<allow_inactive>auth_admin</allow_inactive>
<allow_active>auth_admin_keep</allow_active>
</defaults>
</action>