Description of problem:
  I was using the firewall-config interface to configure a newly upgraded Fedora 19 system to open some services to only a particular subnet in the public zone. I could see the changes I was making work when applied to the "Runtime Configuration"; however, despite applying the changes to the "Permenant Configuration" as well, my changes would not persist after reboot or restart of the the firewalld.service. It really felt like I was missing a step (e.g. File>Save or iptables-save etc.) necessary to capture my changes.


Version-Release number of selected component (if applicable):
firewall-config-0.3.4-1.fc19.noarch


How reproducible:
It seems like the firewall-config Rich Rule settings related to Log and Audit "With Limit" are the cause of the problem.


Steps to Reproduce:
1. Add a new Rich Rule, I was using ipv4 family, service samba, accept
2. Source 192.168.2.0/24
3. Log (checked), Level info, With limit(checked) 2 / second.
4. Audit (checked), With limit(checked) 2 / second.
5. File > Quit
6. systemctl reload firewalld.service

Actual results:
  Either by testing the network, or relaunching firewall-config you will see your changes appear to be lost. This would also include any other changes which you'd made previously that had already been working and persisted properly.

Expected results:
  Changes made in the firewall-config "Permanent Configuration" should be permanent, persisted across reboots / service restarts.


Additional info:
  I did eventually read the right documentation to point me towards /etc/firewalld/zones/public.xml. I could see my changes were saved as expected. Here is the contents of the file:

<?xml version="1.0" encoding="utf-8"?>
<zone>
  <short>Public</short>
  <description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
  <service name="mdns"/>
  <service name="http"/>
  <service name="dhcpv6-client"/>
  <service name="https"/>
  <service name="ssh"/>
  <rule family="ipv4">
    <source address="192.168.2.0/24"/>
    <service name="samba"/>
    <log level="info">
      <limit value="2/s"/>
    </log>
    <audit>
      <limit value="2/s"/>
    </audit>
    <accept/>
  </rule>
</zone>

A little more trial and error led me to the barebones log file /var/log/firewalld. It simply said:

2013-08-17 00:50:10 ERROR: Failed to load zone file '/etc/firewalld/zones/public.xml':

NOTE: If I strip out the <log> and <audit> tags, the file then loads as expected.

I would call this a silent failure. firewalld restarts just fine, only the configuration for any affected zone has reverted to the factory default. It would have been helpful if a screwed up zone file made more noise.