Bug 769457

Description of problem:
I have a kickstart in which the following directives exist:
selinux --disabled
firewall --enabled --service=ssh

I find that livecd-creator will generate images in which port 22 (ssh) is not opened.  I've investigated and believe the problem is with python-imgcreate and the way it calls lokkit in FirewallConfig.apply() and SelinuxConfig.apply().  In both cases the '-f' option is passed, which causes lokkit to ignore any preexisting configuration.  While that's fine for the first call (opening port 22), the second call (to disable SEL) causes /etc/sysconfig/iptables to be rewritten this time without port 22 being opened, thus losing the changes from the first call.


Version-Release number of selected component (if applicable):
livecd-tools-16.9-1.fc16.x86_64
python-imgcreate-16.9-1.fc16.x86_64
system-config-firewall-base-1.2.29-4.fc16.noarch

How reproducible:
always

Steps to Reproduce:
1. Modify an existing kickstart to have the directives shown above.
2. Run livecd-creator to create the image.
3. Boot the image and observe the iptables configuration.
  
Actual results:
Port 22 will not be open.

Expected results:
Port 22 should be open.

Additional info:
I would have filed this under python-imgcreate, but that does not seem to be in the Components list on BZ for some reason.

You can also use the --shell option to livecd-creator and confirm the problem there by alternately running:
/usr/sbin/lokkit -f --verbose --nostart --enabled --service=ssh
and
/usr/sbin/lokkit -f --nostart --selinux=enabled
(as does python-imgcreate) and looking at /etc/sysconfig/iptables after each command.  When I do this, I can clearly see one invocation squashing the settings of the other rather than accumulating those settings as needed.  Dropping the '-f' option on all but the first invocation would seem necessary to get a cumulative effect.