FirewallD provides dbus api for modification of configuration after user has been authenticated via polkit. This does not apply for 5 methods which can be called by any logged user using dbus api or firewall-cmd cli interface. Any predefined policy can be used, server or desktop. list of concerned dbus methods in firewalld.py addPassthrough removePassthrough addEntry removeEntry setEntries Any locally logged in user, could use the above firewalld commands to tamper or change the firewall settings. This flaw was introduced via the following commit: https://github.com/t-woerner/firewalld/commit/6b9867cd5c5e2c83adeec42666521a420e59ef11 It affects all firewalld versions since 0.3.12
Created firewalld tracking bugs for this issue: Affects: fedora-all [bug 1367381]
Public via: http://seclists.org/oss-sec/2016/q3/291
This issue was fixed in firewalld-0.4.3.3 release: http://www.firewalld.org/2016/08/firewalld-0-4-3-3-release/
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2016:2597 https://rhn.redhat.com/errata/RHSA-2016-2597.html