Bug 1452137
| Summary: | firewall-cmd: man page should mention that reload does not purge direct runtime rules | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | lubomir.prda |
| Component: | firewalld | Assignee: | Phil Sutter <psutter> |
| Status: | CLOSED ERRATA | QA Contact: | Tomas Dolezal <todoleza> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 7.3 | CC: | aloughla, atragler, rkhan, sukulkar, todoleza |
| Target Milestone: | rc | Keywords: | ManPageChange |
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | firewalld-0.4.4.4-11.el7 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-04-10 10:30:16 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1472751 | ||
|
Description
lubomir.prda
2017-05-18 12:21:22 UTC
firewalld is trying to keep runtime only direct rules while reloading to minimize the need to recreate rules added by services and applications. There are multiple problems with this approach: 1. Is this documented somewhere? I have tried to find some mention of this in manpages, but was not successful. According them, everything, that is not in config should be purged after reload. 2. Even if this was true, firewalld should not retain rules put in runtime by itself. It should know, that the rule was not created by some service, but itself. Also we do not want other services to punch holes through firewall. That is why firewall is there in the first place. 3. So we are not able to purge unwanted direct rules via remote management at all. No switch? Only complete restart of firewalld? (In reply to lubomir.prda from comment #4) > There are multiple problems with this approach: > > 1. Is this documented somewhere? I have tried to find some mention of this > in manpages, but was not successful. According them, everything, that is not > in config should be purged after reload. This caveat should probably be added to the man page under --reload/--complete-reload. I'll use this BZ as the work item for that. > > 2. Even if this was true, firewalld should not retain rules put in runtime > by itself. It should know, that the rule was not created by some service, > but itself. Also we do not want other services to punch holes through > firewall. That is why firewall is there in the first place. Only applications authenticated via policy kit can add direct rules. > > 3. So we are not able to purge unwanted direct rules via remote management > at all. No switch? Only complete restart of firewalld? You can remove all rules in a given chain. e.g. # firewall-cmd --direct --remove-rules ipv4 filter INPUT Or do something like this to remove direct all rules: # firewall-cmd --direct --get-all-rules |while read LINE; do firewall-cmd --direct --remove-rule $LINE; done Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2018:0702 |