[Bug 1758617] New: Description of interface file/filecontext file
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1758617
Bug ID: 1758617
Summary: Description of interface file/filecontext file
Product: Fedora Documentation
Version: devel
Status: NEW
Component: selinux-user-guide
Assignee: pbokoc(a)redhat.com
Reporter: hein-bloed92(a)gmx.de
QA Contact: docs-qa(a)lists.fedoraproject.org
CC: mprpic(a)redhat.com, pkennedy(a)redhat.com,
zach(a)oglesby.co
Target Milestone: ---
Classification: Fedora
Description of problem:
In my understanding the paragraph "NAME.if - interface file" in Chapter 5.2
describes the file content file.
So the headline of the paragraph should be something like "NAME.fc - file
context file"
Best Regrads
Marcus
--
You are receiving this mail because:
You are the QA Contact for the bug.
4 years, 7 months
[Bug 929426] firewalld: forward chain
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=929426
Juha Tuomala <tuju(a)iki.fi> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |tuju(a)iki.fi
--- Comment #10 from Juha Tuomala <tuju(a)iki.fi> ---
Ha, I was wondering the exactly the same thing and found this bug entry. :)
The whole point firewalld was (I assume) of having a 'daemon' and a user
inteface, which would together provide a safe way to make modifications to
traffic filtering rules without sawing your own branch off where you were
sitting on. Every network specialist knows this risk.
Well, it turns out that firewalld is what I suspected from the start: a
workstation firewall solution, not a network firewall solution.
Which is funny as the term firewall is historically just about the network
device (a wall), not about host filtering.
Which also funny, that it comes with predefined 'zones' like 'dmz'. Well, where
the hell you're supposed to have that DMZ-zone else than in your backbone
network which is protected by network firewall? Maybe with VPN you could
connect it to your workstation and it would make sense. Or not.
Looks like modifying the dmz service rules go into IN_dmz_allow chain, that is
called by hopping chain to antoher:
INPUT
INPUT_ZONES
IN_dmz
IN_dmz_allow
and in case of network firewall, that would be traffic directed to firewall
itself. If it would be traffic that firewall would be routing through itself,
it should be in FORWARD.
Using --direct removes the whole point of having that daemon+userinterface and
removes the benefits they provide. Only thing left are the other limitations,
missing documenation, weird "concepts" and broken XML (and who knows what else
crap).
--
You are receiving this mail because:
You are the QA Contact for the bug.
4 years, 7 months