Hide Forgot
Need the ability to add/remove an interface by PCI device ID to a zone.
*** Bug 1850744 has been marked as a duplicate of this bug. ***
This feature appears to already be supported by the firewall system role. For example, the following options work in the firewall system role as it is currently: firewall: - interface: 8086:15d7 # Intel Corporation Ethernet Connection PCI id state: enabled If the D-bus interface supports adding by PCI device ID, then the system role should as well. @egarver - Are we certain that this feature is not already supported by the system role? For interfaces, we only really restrict user actions with errors that the D-bus interface will raise.
(In reply to Brennan Paciorek from comment #3) > This feature appears to already be supported by the firewall system role. > For example, the following options work in the firewall system role as it is > currently: > firewall: > - interface: 8086:15d7 # Intel Corporation Ethernet Connection PCI id > state: enabled > > If the D-bus interface supports adding by PCI device ID, then the system > role should as well. > > @egarver - Are we certain that this feature is not already > supported by the system role? For interfaces, we only really restrict user > actions with errors that the D-bus interface will raise. Yes. We're certain it is NOT supported. The above is accepted by firewalld, but it doesn't work. The PCI ID is passed directly to firewalld which treats it like a plain interface name. So you end up with rules like this: `iifname "8086:15d7" goto filter_IN_public`. But that should be translated by the role to a real interface name. The NetworkManager integration is done in the UIs. See calls to nm_*() and try_set_zone_of_interface(). The role will have to do something similar. Note: Ideally this magic would be done in the daemon. I don't know the history of why it is not. Maybe it has something to do with user privileges and polkit (authorization).
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (rhel-system-roles bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2022:7568