Bug 669848

Summary: anaconda should not always drag in system-config-firewall-base
Product: [Fedora] Fedora Reporter: Curtis Doty <curtis>
Component: anacondaAssignee: Anaconda Maintenance Team <anaconda-maint-list>
Status: CLOSED WONTFIX QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: low    
Version: rawhideCC: anaconda-maint-list, jonathan, vanmeeuwen+fedora
Target Milestone: ---Keywords: Reopened
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-01-21 14:20:14 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Curtis Doty 2011-01-15 00:31:28 UTC 
In pyanaconda/yuminstall.py:YumBackend().selectAnacondaNeeds() there is a dependency on system-config-firewall-base which then also drags in iptables-ipv6.

Minimalist kickstart installs don't need this and may have these options which are unfortunately ignored:

%packages
-system-config-firewall-base

However, that kickstart config is unfortunately ignored and the package is installed anyways along with any unneeded dependencies it has.

Workaround is to forcibly remove them in %post, but this is ugly and wastes time.
Comment 1 Chris Lumens 2011-01-15 15:12:31 UTC 
This is required to set up the firewall, so we're not going to remove the package requirement.
Comment 2 Curtis Doty 2011-01-15 16:47:01 UTC 
But in this kickstart scenario:

firewall --disabled
%packages
-system-config-firewall-base

It really doesn't need to be installed. Maybe something like this?

(untested)
    def selectAnacondaNeeds(self):
        for pkg in ['authconfig', 'chkconfig']:
            self.selectPackage(pkg)
        if anaconda.firewall:
            self.selectPackage('system-config-firewall-base')

Thanks for considering.
Comment 3 Chris Lumens 2011-01-21 14:20:14 UTC 
The thing is, we also use lokkit (included in s-c-f-b) to disable the firewall.  This has the advantage of anaconda not needing to know what the default state of the firewall config as shipped.  This really is a bit of a corner case, and you've already got a workaround.