[PATCH] update to use firewalld (#815540)
Brian C. Lane
bcl at redhat.com
Wed Oct 3 19:40:05 UTC 2012
From: "Brian C. Lane" <bcl at redhat.com>
NOTE: This depends on firewalld changes and will be held until they are pushed.
---
pyanaconda/__init__.py | 4 +-
pyanaconda/firewall.py | 80 ----------------------------------
pyanaconda/install.py | 3 +-
pyanaconda/kickstart.py | 32 ++++++++++++++
tests/pyanaconda_test/firewall_test.py | 41 -----------------
5 files changed, 35 insertions(+), 125 deletions(-)
delete mode 100644 pyanaconda/firewall.py
delete mode 100644 tests/pyanaconda_test/firewall_test.py
diff --git a/pyanaconda/__init__.py b/pyanaconda/__init__.py
index 8948fdb..4abca2e 100644
--- a/pyanaconda/__init__.py
+++ b/pyanaconda/__init__.py
@@ -43,7 +43,7 @@ _ = lambda x: gettext.ldgettext("anaconda", x)
class Anaconda(object):
def __init__(self):
- import desktop, firewall
+ import desktop
from flags import flags
self._backend = None
@@ -53,7 +53,6 @@ class Anaconda(object):
self.dir = None
self.displayMode = None
self.extraModules = []
- self.firewall = firewall.Firewall()
self.id = None
self._instClass = None
self._intf = None
@@ -242,4 +241,3 @@ class Anaconda(object):
network.disableNMForStorageDevices(self.storage)
network.autostartFCoEDevices(self.storage)
self.desktop.write()
- self.firewall.write()
diff --git a/pyanaconda/firewall.py b/pyanaconda/firewall.py
deleted file mode 100644
index 5e82cba..0000000
--- a/pyanaconda/firewall.py
+++ /dev/null
@@ -1,80 +0,0 @@
-#
-# firewall.py - firewall install data and installation
-#
-# Copyright (C) 2004 Red Hat, Inc. All rights reserved.
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program. If not, see <http://www.gnu.org/licenses/>.
-#
-# Author(s): Bill Nottingham <notting at redhat.com>
-# Jeremy Katz <katzj at redhat.com>
-#
-
-import iutil
-import os.path
-from flags import flags
-from constants import *
-
-import gettext
-_ = lambda x: gettext.ldgettext("anaconda", x)
-
-import logging
-log = logging.getLogger("anaconda")
-
-class Firewall:
- def __init__ (self):
- self.enabled = 1
- self.trustdevs = []
- self.portlist = []
- self.servicelist = []
-
- def getArgList(self):
- args = []
-
- if not self.enabled:
- args.append("--disabled")
- return args
-
- if not "ssh" in self.servicelist and not "22:tcp" in self.portlist:
- args += ["--service=ssh"]
-
- for dev in self.trustdevs:
- args = args + [ "--trust=%s" %(dev,) ]
-
- for port in self.portlist:
- args = args + [ "--port=%s" %(port,) ]
-
- for service in self.servicelist:
- args = args + [ "--service=%s" % (service,) ]
-
- return args
-
- def write (self):
- args = [ "--quiet", "--nostart", "-f" ] + self.getArgList()
-
- try:
- if not os.path.exists("%s/etc/sysconfig/iptables" %(ROOT_PATH,)):
- iutil.execWithRedirect("/usr/sbin/lokkit", args,
- root=ROOT_PATH, stdout="/dev/null",
- stderr="/dev/null")
- else:
- log.error("would have run %s", args)
- except (RuntimeError, OSError) as msg:
- log.error ("lokkit run failed: %s", msg)
- else:
- f = open(ROOT_PATH +
- '/etc/sysconfig/system-config-firewall', 'w')
- f.write("# system-config-firewall config written out by anaconda\n\n")
- for arg in args[3:]:
- f.write("%s\n" %(arg,))
- f.close()
diff --git a/pyanaconda/install.py b/pyanaconda/install.py
index b716364..3192862 100644
--- a/pyanaconda/install.py
+++ b/pyanaconda/install.py
@@ -58,6 +58,7 @@ def doConfiguration(storage, payload, ksdata, instClass):
ksdata.keyboard.execute(storage, ksdata, instClass)
ksdata.timezone.execute(storage, ksdata, instClass)
ksdata.lang.execute(storage, ksdata, instClass)
+ ksdata.firewall.execute(storage, ksdata, instClass)
with progress_report(_("Writing network configuration")):
writeNetworkConf(storage, ksdata, instClass)
@@ -107,7 +108,7 @@ def doInstall(storage, payload, ksdata, instClass):
# anaconda requires storage packages in order to make sure the target
# system is bootable and configurable, and some other packages in order
# to finish setting up the system.
- packages = storage.packages + ["authconfig", "system-config-firewall-base"]
+ packages = storage.packages + ["authconfig", "firewalld"]
payload.preInstall(packages=packages, groups=payload.languageGroups(ksdata.lang.lang))
payload.install()
diff --git a/pyanaconda/kickstart.py b/pyanaconda/kickstart.py
index 18b04c0..639527c 100644
--- a/pyanaconda/kickstart.py
+++ b/pyanaconda/kickstart.py
@@ -452,6 +452,37 @@ class Fcoe(commands.fcoe.F13_Fcoe):
return fc
+class Firewall(commands.firewall.F14_Firewall):
+ def execute(self, storage, ksdata, instClass):
+ args = []
+ # enabled is None is neither --enable or --disable is passed
+ # default to enabled if nothing has been set.
+ if self.enabled == False:
+ args += ["--disabled"]
+ else:
+ args += ["--enabled"]
+
+ if not "ssh" in self.services and not "22:tcp" in self.ports:
+ args += ["--service=ssh"]
+
+ for dev in self.trusts:
+ args += [ "--trust=%s" % (dev,) ]
+
+ for port in self.ports:
+ args += [ "--port=%s" % (port,) ]
+
+ for service in self.services:
+ args += [ "--service=%s" % (service,) ]
+
+ cmd = "/usr/bin/firewall-convert-scfw-config"
+ if not os.path.exists(ROOT_PATH+cmd):
+ msg = _("%s is missing. Cannot setup firewall.") % (cmd,)
+ raise KickstartError(msg)
+ else:
+ iutil.execWithRedirect(cmd, args,
+ stdout="/dev/tty5", stderr="/dev/tty5",
+ root=ROOT_PATH)
+
class Firstboot(commands.firstboot.FC3_Firstboot):
def execute(self, *args):
if not os.path.exists(ROOT_PATH + "/lib/systemd/system/firstboot-graphical.service"):
@@ -1385,6 +1416,7 @@ commandMap = {
"clearpart": ClearPart,
"dmraid": DmRaid,
"fcoe": Fcoe,
+ "firewall": Firewall,
"firstboot": Firstboot,
"group": Group,
"ignoredisk": IgnoreDisk,
diff --git a/tests/pyanaconda_test/firewall_test.py b/tests/pyanaconda_test/firewall_test.py
deleted file mode 100644
index 19c4554..0000000
--- a/tests/pyanaconda_test/firewall_test.py
+++ /dev/null
@@ -1,41 +0,0 @@
-import mock
-
-class FirewallTest(mock.TestCase):
- def setUp(self):
- self.setupModules(["_isys", "block", "ConfigParser"])
-
- self.fs = mock.DiskIO()
-
- import pyanaconda.firewall
-
- self.modifiedModule("pyanaconda.firewall")
- self.modifiedModule("os.path")
-
- pyanaconda.firewall.open = self.fs.open
- pyanaconda.firewall.log = mock.Mock()
- pyanaconda.firewall.iutil = mock.Mock()
- pyanaconda.firewall.os = mock.Mock()
- pyanaconda.firewall.os.path = mock.Mock()
- pyanaconda.firewall.os.path.exists = self.fs.os_path_exists
-
- def tearDown(self):
- self.tearDownModules()
-
- def default_write_test(self):
- import pyanaconda.firewall
- fw = pyanaconda.firewall.Firewall()
- fw.write()
-
- self.assertEqual(pyanaconda.firewall.iutil.method_calls, [
- ("execWithRedirect",
- (
- "/usr/sbin/lokkit",
- [ "--quiet", "--nostart", "-f", "--service=ssh" ]
- ),
- {
- "root": "/mnt/sysimage",
- "stdout": "/dev/null",
- "stderr": "/dev/null",
- }
- )
- ])
--
1.7.11.4
More information about the anaconda-patches
mailing list