Bug 2539854 - firewalld should require libcap-ng-python3
Summary: firewalld should require libcap-ng-python3
Keywords:
Status: NEW
Alias: None
Product: Fedora
Classification: Fedora
Component: firewalld
Version: 44
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Eric Garver
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-24 01:32 UTC by Tavi
Modified: 2026-09-28 16:03 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Type: Bug
Embargoed:

Attachments (Terms of Use)

Description Tavi 2026-09-24 01:32:31 UTC 
Description of problem:
firewalld may silently be unable to drop caps in some cases


Version-Release number of selected component (if applicable):
44


How reproducible:
sometimes


Steps to Reproduce:
1. install firewalld on a system with weak deps set


Actual results:
see libcap-ng-python3 not installed


Expected results:
see libcap-ng-python3 installed and firewalld print that it correctly dropped linux caps


Additional info:
relevant firewalld code here: https://github.com/firewalld/firewalld/blob/5019f0ccae0c07ba9e50abc794596f220fff65b9/src/firewalld.in#L189-L226
Comment 1 Tavi 2026-09-24 01:47:39 UTC 
or maybe instead remove it and have the systemd unit enforce it via CapabilityBoundingSet instead?
Comment 2 Eric Garver 2026-09-28 16:03:45 UTC 
It already Recommends it and dropping capabilities is optional. So yeah - a weak deps install means it won't pull int libcap-ng-python3. That intentional.

This is a WONFIX, imo.
Note You need to log in before you can comment on or make changes to this bug.