[f18-branch/master] return to using lokkit for firewall setup (#885807)
Brian C. Lane
bcl at redhat.com
Tue Dec 11 18:49:27 UTC 2012
From: "Brian C. Lane" <bcl at redhat.com>
firewalld has some issues, especially with minimal installs and dragging
in a bunch of X dependencies.
This returns to using lokkit for firewall. The differences from before are:
- require lokkit instead of system-config-firewall-base so that maybe
something else could provide lokkit with the same cmdline args.
- don't use -f which would override the selinux setting which we are
still setting directly.
---
anaconda.spec.in | 3 +--
pyanaconda/install.py | 2 +-
pyanaconda/kickstart.py | 24 ++++++++++++++++--------
3 files changed, 18 insertions(+), 11 deletions(-)
diff --git a/anaconda.spec.in b/anaconda.spec.in
index 9637c6f..a665b59 100644
--- a/anaconda.spec.in
+++ b/anaconda.spec.in
@@ -43,7 +43,6 @@ BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
%define sckeyboardver 1.3.1
%define libblkidver 2.17.1-1
%define fcoeutilsver 1.0.12-3.20100323git
-%define firewalldver 0.2.9-1
%define pythonurlgrabberver 3.9.1-5
%define utillinuxver 2.15.1
%define syslinuxver 3.73
@@ -121,7 +120,7 @@ Requires: dmidecode
Requires: python-pyblock >= %{pythonpyblockver}
Requires: libuser-python
Requires: authconfig
-Requires: firewalld >= %{firewalldver}
+Requires: lokkit
Requires: cryptsetup-luks
Requires: python-cryptsetup >= %{pythoncryptsetupver}
Requires: mdadm
diff --git a/pyanaconda/install.py b/pyanaconda/install.py
index 6754a0a..54defc9 100644
--- a/pyanaconda/install.py
+++ b/pyanaconda/install.py
@@ -120,7 +120,7 @@ def doInstall(storage, payload, ksdata, instClass):
# anaconda requires storage packages in order to make sure the target
# system is bootable and configurable, and some other packages in order
# to finish setting up the system.
- packages = storage.packages + ["authconfig", "firewalld"]
+ packages = storage.packages + ["authconfig", "lokkit"]
payload.preInstall(packages=packages, groups=payload.languageGroups(ksdata.lang.lang))
payload.install()
diff --git a/pyanaconda/kickstart.py b/pyanaconda/kickstart.py
index 1ec294a..6ef1e77 100644
--- a/pyanaconda/kickstart.py
+++ b/pyanaconda/kickstart.py
@@ -457,7 +457,7 @@ class Fcoe(commands.fcoe.F13_Fcoe):
class Firewall(commands.firewall.F14_Firewall):
def execute(self, storage, ksdata, instClass):
- args = []
+ args = ["--quiet", "--nostart"]
# enabled is None if neither --enable or --disable is passed
# default to enabled if nothing has been set.
if self.enabled == False:
@@ -477,14 +477,22 @@ class Firewall(commands.firewall.F14_Firewall):
for service in self.services:
args += [ "--service=%s" % (service,) ]
- cmd = "/usr/bin/firewall-offline-cmd"
- if not os.path.exists(ROOT_PATH+cmd):
- msg = _("%s is missing. Cannot setup firewall.") % (cmd,)
- raise KickstartError(msg)
+ cmd = "/usr/sbin/lokkit"
+ try:
+ if not os.path.exists(ROOT_PATH + "/etc/sysconfig/iptables"):
+ iutil.execWithRedirect(cmd, args,
+ stdout="/dev/tty5", stderr="/dev/tty5",
+ root=ROOT_PATH)
+ else:
+ log.error("/etc/sysconfig/iptables exists, skipping lokkit. "
+ "Would have run %s", args)
+ except (RuntimeError, OSError) as msg:
+ log.error ("lokkit run failed: %s", msg)
else:
- iutil.execWithRedirect(cmd, args,
- stdout="/dev/tty5", stderr="/dev/tty5",
- root=ROOT_PATH)
+ with open(ROOT_PATH + "/etc/sysconfig/system-config-firewall", "w") as f:
+ f.write("# system-config-firewall config written out by anaconda\n\n")
+ for arg in args[2:]:
+ f.write("%s\n" %(arg,))
class Firstboot(commands.firstboot.FC3_Firstboot):
def execute(self, *args):
--
1.8.0
More information about the anaconda-patches
mailing list