Bug 1237242 - Error: RT_TO_PERM_FAILED: zone 'dmz' : ZONE_CONFLICT when doing --runtime-to-permanent
Summary: Error: RT_TO_PERM_FAILED: zone 'dmz' : ZONE_CONFLICT when doing --runtime-to-...
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: firewalld
Version: 7.1
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Thomas Woerner
QA Contact: Tomas Dolezal
URL:
Whiteboard:
Keywords:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-06-30 15:29 UTC by James Hogarth
Modified: 2016-11-03 21:01 UTC (History)
2 users (show)

(edit)
Clone Of:
(edit)
Last Closed: 2016-11-03 21:01:05 UTC


Attachments (Terms of Use)
screenshot of a C7 VM showing it working on a couple of zones and then failing (25.85 KB, image/png)
2015-06-30 15:43 UTC, James Hogarth
no flags Details


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:2597 normal SHIPPED_LIVE Moderate: firewalld security, bug fix, and enhancement update 2016-11-03 12:11:47 UTC

Description James Hogarth 2015-06-30 15:29:13 UTC
Description of problem:
On editing zones sometimes this error is generated when trying to save runtime config to permanent after adding a service. It appears mostly consistent on these steps but I've saved runtime on public before in the past and this is failing now. It's worth trying dmz or work or similar if on trying to reproduce public works.

Version-Release number of selected component (if applicable):
firewalld-0.3.9-11.el7.noarch

How reproducible:
Always on certain zones

Steps to Reproduce:
1. firewall-cmd --set-default-zone=public
2. firewall-cmd --list-all
public (default, active)
  interfaces: eth0
  sources: 
  services: dhcpv6-client ssh
  ports: 
  masquerade: no
  forward-ports: 
  icmp-blocks: 
  rich rules: 
3.firewall-cmd --add-service=ntp
4. firewall-cmd --list-all
public (default, active)
  interfaces: eth0
  sources: 
  services: dhcpv6-client ntp ssh
  ports: 
  masquerade: no
  forward-ports: 
  icmp-blocks: 
  rich rules: 
4. firewall-cmd --runtime-to-permanent
Error: RT_TO_PERM_FAILED: zone 'public' : ZONE_CONFLICT


Actual results:
Error: RT_TO_PERM_FAILED: zone 'public' : ZONE_CONFLICT


Expected results:
'success' being shown and the current firewalld runtime being committed to disk

Additional info:
using firewall-cmd --add-service=ntp --permanent correctly writes the changes to disk but defeats the point of the runtime-to-permanent capability to safely make certain changes (perhaps with an "echo firewalld-cmd --reload | at 15 mins" for safety) and then commit them to disk.

Comment 3 James Hogarth 2015-06-30 15:43:50 UTC
Created attachment 1044711 [details]
screenshot of a C7 VM showing it working on a couple of zones and then failing

Comment 11 errata-xmlrpc 2016-11-03 21:01:05 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2016-2597.html


Note You need to log in before you can comment on or make changes to this bug.