|Summary:||RFE: firewall kickstart command which does not require firewalld|
|Product:||[Fedora] Fedora||Reporter:||Matthew Miller <mattdm>|
|Component:||anaconda||Assignee:||Anaconda Maintenance Team <anaconda-maint-list>|
|Status:||CLOSED CURRENTRELEASE||QA Contact:||Fedora Extras Quality Assurance <extras-qa>|
|Version:||20||CC:||anaconda-maint-list, bcl, clumens, g.kaviyarasu, jonathan, ricardo.arguello, vanmeeuwen+fedora|
|Fixed In Version:||Doc Type:||Bug Fix|
|Doc Text:||Story Points:||---|
|Last Closed:||2014-01-29 20:35:34 UTC||Type:||Bug|
|oVirt Team:||---||RHEL 7.3 requirements from Atomic Host:|
|Cloudforms Team:||---||Target Upstream Version:|
|Bug Depends On:|
Description Matthew Miller 2013-09-05 22:34:47 UTC
This is a continuation of bug #815540 except I'm trying to be less alarmist and also less whiny. :) I'm trying to use create-appliance to build lightweight images. I'd even like to eventually do this with anaconda itself. There are some other ways to do this, but there are advantages to using a real installer as well. Because this is a container environment, it doesn't need to be running any firewall. However, firewall --disaabled results in failure with Unable to run ['/usr/bin/firewall-offline-cmd', '--disabled']! Could this either be made to not do anything, or a new parameter like "firewall --ignore" be added? With the cloud kickstart image, we chose to put workarounds in the %post script. With the container (which may not even have yum), the workarounds get really crazy. We could come up with some new lightweight appliance creation tool, but really, I'd like there to be _more_ convergence here, not less.
Comment 1 Brian Lane 2013-09-05 23:48:48 UTC
The reason why it raises the error is that in the case where you want to be sure the firewall is disabled you'd like to know if that disable failed. Although I guess it could be argued that if the tool is missing odds are it's going to be disabled. Why not just remove the firewall command from your kickstart? Also, you really should be using livemedia-creator ;)
Comment 2 Matthew Miller 2013-09-06 01:28:31 UTC
(In reply to Brian C. Lane from comment #1) > The reason why it raises the error is that in the case where you want to be > sure the firewall is disabled you'd like to know if that disable failed. > Although I guess it could be argued that if the tool is missing odds are > it's going to be disabled. > > Why not just remove the firewall command from your kickstart? Well, in appliance-creator at least, absence of the firewall line is treated as if you gave 'firewall --enabled'. I see the point of having the error raised for failed disabled; maybe a separate parameter like "firewall --ignore" for this case? Or, make the missing line mean that, but people might be expecting the missing=default=enable behavior. > Also, you really should be using livemedia-creator ;) Well, the idea right now is to make it work with something that is already in koji.
Comment 3 Fedora Update System 2013-09-25 16:04:15 UTC
anaconda-20.20-1.fc20 has been submitted as an update for Fedora 20. https://admin.fedoraproject.org/updates/anaconda-20.20-1.fc20
Comment 4 Matthew Miller 2013-09-25 22:57:59 UTC
Awesome -- thank you!
Comment 5 Fedora Update System 2013-09-27 00:32:22 UTC
Package anaconda-20.20-1.fc20: * should fix your issue, * was pushed to the Fedora 20 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing anaconda-20.20-1.fc20' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2013-17681/anaconda-20.20-1.fc20 then log in and leave karma (feedback).
Comment 6 Fedora Update System 2013-09-28 01:17:11 UTC
anaconda-20.21-1.fc20 has been submitted as an update for Fedora 20. https://admin.fedoraproject.org/updates/anaconda-20.21-1.fc20
Comment 7 Brian Lane 2013-10-02 17:32:31 UTC
*** Bug 884878 has been marked as a duplicate of this bug. ***
Comment 8 Chris Lumens 2014-04-01 14:51:38 UTC
Don't mind me - just moving this to the component that includes the fix so I don't confuse myself again later on.