[f18-branch/master] return to using lokkit for firewall setup (#885807)

Brian C. Lane bcl at redhat.com
Tue Dec 11 18:49:27 UTC 2012


From: "Brian C. Lane" <bcl at redhat.com>

firewalld has some issues, especially with minimal installs and dragging
in a bunch of X dependencies.

This returns to using lokkit for firewall. The differences from before are:
 - require lokkit instead of system-config-firewall-base so that maybe
   something else could provide lokkit with the same cmdline args.
 - don't use -f which would override the selinux setting which we are
   still setting directly.
---
 anaconda.spec.in        |  3 +--
 pyanaconda/install.py   |  2 +-
 pyanaconda/kickstart.py | 24 ++++++++++++++++--------
 3 files changed, 18 insertions(+), 11 deletions(-)

diff --git a/anaconda.spec.in b/anaconda.spec.in
index 9637c6f..a665b59 100644
--- a/anaconda.spec.in
+++ b/anaconda.spec.in
@@ -43,7 +43,6 @@ BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 %define sckeyboardver 1.3.1
 %define libblkidver 2.17.1-1
 %define fcoeutilsver 1.0.12-3.20100323git
-%define firewalldver 0.2.9-1
 %define pythonurlgrabberver 3.9.1-5
 %define utillinuxver 2.15.1
 %define syslinuxver 3.73
@@ -121,7 +120,7 @@ Requires: dmidecode
 Requires: python-pyblock >= %{pythonpyblockver}
 Requires: libuser-python
 Requires: authconfig
-Requires: firewalld >= %{firewalldver}
+Requires: lokkit
 Requires: cryptsetup-luks
 Requires: python-cryptsetup >= %{pythoncryptsetupver}
 Requires: mdadm
diff --git a/pyanaconda/install.py b/pyanaconda/install.py
index 6754a0a..54defc9 100644
--- a/pyanaconda/install.py
+++ b/pyanaconda/install.py
@@ -120,7 +120,7 @@ def doInstall(storage, payload, ksdata, instClass):
     # anaconda requires storage packages in order to make sure the target
     # system is bootable and configurable, and some other packages in order
     # to finish setting up the system.
-    packages = storage.packages + ["authconfig", "firewalld"]
+    packages = storage.packages + ["authconfig", "lokkit"]
     payload.preInstall(packages=packages, groups=payload.languageGroups(ksdata.lang.lang))
     payload.install()
 
diff --git a/pyanaconda/kickstart.py b/pyanaconda/kickstart.py
index 1ec294a..6ef1e77 100644
--- a/pyanaconda/kickstart.py
+++ b/pyanaconda/kickstart.py
@@ -457,7 +457,7 @@ class Fcoe(commands.fcoe.F13_Fcoe):
 
 class Firewall(commands.firewall.F14_Firewall):
     def execute(self, storage, ksdata, instClass):
-        args = []
+        args = ["--quiet", "--nostart"]
         # enabled is None if neither --enable or --disable is passed
         # default to enabled if nothing has been set.
         if self.enabled == False:
@@ -477,14 +477,22 @@ class Firewall(commands.firewall.F14_Firewall):
         for service in self.services:
             args += [ "--service=%s" % (service,) ]
 
-        cmd = "/usr/bin/firewall-offline-cmd"
-        if not os.path.exists(ROOT_PATH+cmd):
-            msg = _("%s is missing. Cannot setup firewall.") % (cmd,)
-            raise KickstartError(msg)
+        cmd = "/usr/sbin/lokkit"
+        try:
+            if not os.path.exists(ROOT_PATH + "/etc/sysconfig/iptables"):
+                iutil.execWithRedirect(cmd, args,
+                                       stdout="/dev/tty5", stderr="/dev/tty5",
+                                       root=ROOT_PATH)
+            else:
+                log.error("/etc/sysconfig/iptables exists, skipping lokkit. "
+                          "Would have run %s", args)
+        except (RuntimeError, OSError) as msg:
+            log.error ("lokkit run failed: %s", msg)
         else:
-            iutil.execWithRedirect(cmd, args,
-                                   stdout="/dev/tty5", stderr="/dev/tty5",
-                                   root=ROOT_PATH)
+            with open(ROOT_PATH + "/etc/sysconfig/system-config-firewall", "w") as f:
+                f.write("# system-config-firewall config written out by anaconda\n\n")
+                for arg in args[2:]:
+                    f.write("%s\n" %(arg,))
 
 class Firstboot(commands.firstboot.FC3_Firstboot):
     def execute(self, *args):
-- 
1.8.0



More information about the anaconda-patches mailing list