Bug 2003008
| Summary: | firewalld fails to insert nf_nat_ftp module [rhel-9.0.0] | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | RHEL Program Management Team <pgm-rhel-tools> |
| Component: | firewalld | Assignee: | Eric Garver <egarver> |
| Status: | CLOSED ERRATA | QA Contact: | qe-baseos-daemons |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | unspecified | CC: | egarver, jpazdziora, lvrabec, mmalik, pvlasin, ssekidde, todoleza |
| Target Milestone: | rc | Keywords: | Triaged, Upstream |
| Target Release: | --- | Flags: | pm-rhel:
mirror+
|
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | firewalld-1.0.0-4.el9 | Doc Type: | No Doc Update |
| Doc Text: | Story Points: | --- | |
| Clone Of: | 1999102 | Environment: | |
| Last Closed: | 2022-05-17 15:59:15 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1999102 | ||
| Bug Blocks: | |||
|
Comment 1
Eric Garver
2021-09-10 12:47:47 UTC
Upstream:
13801962073f ("fix(firewalld): keep linux capability CAP_SYS_MODULE")
Would it be possible to isolate loading the kernel modules to separate helper utility with separate capabilities, so that the daemon itself would not need them? (In reply to Jan Pazdziora from comment #8) > Would it be possible to isolate loading the kernel modules to separate > helper utility with separate capabilities, so that the daemon itself would > not need them? Probably possible. What is the intent? Some of the module loading happens by firewalld itself (e.g. nf_nat_ftp). But invoking iptables-legacy (maybe this counts as a helper utility) also causes some modules to implicitly load. The change mentioned in comment 2 address both. The intent would be to separate the security domains of distinct types of operations and separate them through interfaces (albeit invoking script via sudo with certain parameters), with the goal of minimizing attack surface. A daemon loading modules itself could be tricked to load different module. It that operation is moved to a narrow-purpose utility that cannot do anything but load three or four modules whose names it checks, any potential future vulnerability in the daemon itself would have smaller impact. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (new packages: firewalld), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2022:3993 |