From bdce9ffed2961d48793216b4849bb71f2a02fa90 Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: May 17 2022 10:29:23 +0000 Subject: import firewalld-1.0.0-4.el9 --- diff --git a/.firewalld.metadata b/.firewalld.metadata new file mode 100644 index 0000000..555e94a --- /dev/null +++ b/.firewalld.metadata @@ -0,0 +1 @@ +8ae534ae5675079eb893406ec88b52ee7f88cb6b SOURCES/firewalld-1.0.0.tar.gz diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..ccb330f --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +SOURCES/firewalld-1.0.0.tar.gz diff --git a/SOURCES/0001-RHEL-only-Add-cockpit-by-default-to-some-zones.patch b/SOURCES/0001-RHEL-only-Add-cockpit-by-default-to-some-zones.patch new file mode 100644 index 0000000..a10914d --- /dev/null +++ b/SOURCES/0001-RHEL-only-Add-cockpit-by-default-to-some-zones.patch @@ -0,0 +1,99 @@ +From 174b42b2943200a7b2ec2dab6c3445158aa04aba Mon Sep 17 00:00:00 2001 +From: Eric Garver +Date: Tue, 25 May 2021 13:31:41 -0400 +Subject: [PATCH] RHEL only: Add cockpit by default to some zones + +Fixes: #1581578 +--- + config/zones/home.xml | 1 + + config/zones/internal.xml | 1 + + config/zones/public.xml | 1 + + config/zones/work.xml | 1 + + src/tests/functions.at | 20 ++++++++++++++++++++ + 5 files changed, 24 insertions(+) + +diff --git a/config/zones/home.xml b/config/zones/home.xml +index d73c9bdb16b6..33064688367e 100644 +--- a/config/zones/home.xml ++++ b/config/zones/home.xml +@@ -6,5 +6,6 @@ + + + ++ + + +diff --git a/config/zones/internal.xml b/config/zones/internal.xml +index 053c18ccda8b..852b16ad94dd 100644 +--- a/config/zones/internal.xml ++++ b/config/zones/internal.xml +@@ -6,5 +6,6 @@ + + + ++ + + +diff --git a/config/zones/public.xml b/config/zones/public.xml +index 49fc4c20af52..62bc751de448 100644 +--- a/config/zones/public.xml ++++ b/config/zones/public.xml +@@ -4,5 +4,6 @@ + For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted. + + ++ + + +diff --git a/config/zones/work.xml b/config/zones/work.xml +index f1a14a9b4682..27b54a7783c4 100644 +--- a/config/zones/work.xml ++++ b/config/zones/work.xml +@@ -4,5 +4,6 @@ + For use in work areas. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted. + + ++ + + +diff --git a/src/tests/functions.at b/src/tests/functions.at +index 3f343ef49de1..c950a3c7a1a6 100644 +--- a/src/tests/functions.at ++++ b/src/tests/functions.at +@@ -106,6 +106,14 @@ m4_define([FWD_START_TEST], [ + fi + + m4_ifdef([TESTING_FIREWALL_OFFLINE_CMD], [ ++ AT_KEYWORDS(offline) ++ dnl cockpit is added by default downstream, but upstream tests don't expect ++ dnl it. Simply remove it at the start of every test. ++ dnl ++ FWD_OFFLINE_CHECK([--zone home --remove-service-from-zone cockpit], 0, [ignore]) ++ FWD_OFFLINE_CHECK([--zone internal --remove-service-from-zone cockpit], 0, [ignore]) ++ FWD_OFFLINE_CHECK([--zone public --remove-service-from-zone cockpit], 0, [ignore]) ++ FWD_OFFLINE_CHECK([--zone work --remove-service-from-zone cockpit], 0, [ignore]) + ], [ + dnl set the appropriate backend + AT_CHECK([sed -i 's/^FirewallBackend.*/FirewallBackend=FIREWALL_BACKEND/' ./firewalld.conf]) +@@ -237,6 +245,18 @@ m4_define([FWD_START_TEST], [ + ]) + + FWD_START_FIREWALLD ++ ++ dnl cockpit is added by default downstream, but upstream tests don't expect ++ dnl it. Simply remove it at the start of every test. ++ dnl ++ FWD_CHECK([--permanent --zone home --remove-service cockpit], 0, [ignore]) ++ FWD_CHECK([ --zone home --remove-service cockpit], 0, [ignore]) ++ FWD_CHECK([--permanent --zone internal --remove-service cockpit], 0, [ignore]) ++ FWD_CHECK([ --zone internal --remove-service cockpit], 0, [ignore]) ++ FWD_CHECK([--permanent --zone public --remove-service cockpit], 0, [ignore]) ++ FWD_CHECK([ --zone public --remove-service cockpit], 0, [ignore]) ++ FWD_CHECK([--permanent --zone work --remove-service cockpit], 0, [ignore]) ++ FWD_CHECK([ --zone work --remove-service cockpit], 0, [ignore]) + ]) + ]) + +-- +2.27.0 + diff --git a/SOURCES/0002-fix-firewalld-keep-linux-capability-CAP_SYS_MODULE.patch b/SOURCES/0002-fix-firewalld-keep-linux-capability-CAP_SYS_MODULE.patch new file mode 100644 index 0000000..714e43d --- /dev/null +++ b/SOURCES/0002-fix-firewalld-keep-linux-capability-CAP_SYS_MODULE.patch @@ -0,0 +1,54 @@ +From 09cdc166ddfe53b6e8ce3a2920f798320c170b7f Mon Sep 17 00:00:00 2001 +From: Eric Garver +Date: Wed, 11 Aug 2021 14:47:59 -0400 +Subject: [PATCH 2/3] fix(firewalld): keep linux capability CAP_SYS_MODULE + +When firewalld calls ip6tables it may implicitly load the ip6_tables, et +al kernel modules. As such we need to retain CAP_SYS_MODULE so that +implicit module is allowed. Otherwise we get EPERM from the kernel. + +This only affects the -legacy variants and the top level table/chain +modules. The userspace binaries will modprobe the kernel modules. +Extensions, e.g. xt_conntrack, are implicitly loaded by the kernel based +on the rules being added and thus not subject to linux capabilities +checks. + +The -nft variants are unaffected because they use the nftables +infrastructure which has implicit module loading in the kernel similar +to the iptables extensions (xt_* modules). + +Fixes: rhbz 1990271 +Fixes: fb0532e8a200 ("feat(firewalld): drop linux capabilities") +(cherry picked from commit 13801962073f478c68d818b314091badcf8b5614) +(cherry picked from commit d3cd7e088f946c75593b0569bd658266b2e9329d) +--- + src/firewalld.in | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/src/firewalld.in b/src/firewalld.in +index abcbe3508f86..b1c886c6f02f 100755 +--- a/src/firewalld.in ++++ b/src/firewalld.in +@@ -136,6 +136,7 @@ def startup(args): + # attempt to drop Linux capabilities to a minimal set: + # - CAP_NET_ADMIN + # - CAP_NET_RAW ++ # - CAP_SYS_MODULE + try: + import capng + capng.capng_clear(capng.CAPNG_SELECT_BOTH) +@@ -143,8 +144,10 @@ def startup(args): + capng.CAP_NET_ADMIN) + capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET, + capng.CAP_NET_RAW) ++ capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET, ++ capng.CAP_SYS_MODULE) + capng.capng_apply(capng.CAPNG_SELECT_BOTH) +- log.info(log.INFO1, "Dropped Linux capabilities to NET_ADMIN, NET_RAW.") ++ log.info(log.INFO1, "Dropped Linux capabilities to NET_ADMIN, NET_RAW, SYS_MODULE.") + except ImportError: + pass + +-- +2.31.1 + diff --git a/SOURCES/0003-fix-firewalld-check-capng_apply-return-code.patch b/SOURCES/0003-fix-firewalld-check-capng_apply-return-code.patch new file mode 100644 index 0000000..b93f0ea --- /dev/null +++ b/SOURCES/0003-fix-firewalld-check-capng_apply-return-code.patch @@ -0,0 +1,48 @@ +From 4a627847d36afedfca20026fb763fbb71005b92f Mon Sep 17 00:00:00 2001 +From: Eric Garver +Date: Mon, 30 Aug 2021 13:24:47 -0400 +Subject: [PATCH 3/3] fix(firewalld): check capng_apply() return code + +If dropping capabilities is blocked by SELinux, e.g. old selinux-policy, +then capng_apply() will return non-zero. Also check other things that +may fail, i.e. capng_update(). + +Fixes: rhbz 1999090 +(cherry picked from commit 36749f512bbcfc55f0e9e46354009073941d7363) +(cherry picked from commit cf7f3320c78a8b3f2b8f22779c5747f113d25c57) +--- + src/firewalld.in | 18 ++++++++++-------- + 1 file changed, 10 insertions(+), 8 deletions(-) + +diff --git a/src/firewalld.in b/src/firewalld.in +index b1c886c6f02f..38331a0b49a9 100755 +--- a/src/firewalld.in ++++ b/src/firewalld.in +@@ -140,14 +140,16 @@ def startup(args): + try: + import capng + capng.capng_clear(capng.CAPNG_SELECT_BOTH) +- capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET, +- capng.CAP_NET_ADMIN) +- capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET, +- capng.CAP_NET_RAW) +- capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET, +- capng.CAP_SYS_MODULE) +- capng.capng_apply(capng.CAPNG_SELECT_BOTH) +- log.info(log.INFO1, "Dropped Linux capabilities to NET_ADMIN, NET_RAW, SYS_MODULE.") ++ if capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET, ++ capng.CAP_NET_ADMIN) or \ ++ capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET, ++ capng.CAP_NET_RAW) or \ ++ capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET, ++ capng.CAP_SYS_MODULE) or \ ++ capng.capng_apply(capng.CAPNG_SELECT_BOTH): ++ log.info(log.INFO1, "libcap-ng failed to drop Linux capabilities.") ++ else: ++ log.info(log.INFO1, "Dropped Linux capabilities to NET_ADMIN, NET_RAW, SYS_MODULE.") + except ImportError: + pass + +-- +2.31.1 + diff --git a/SPECS/firewalld.spec b/SPECS/firewalld.spec new file mode 100644 index 0000000..1245be3 --- /dev/null +++ b/SPECS/firewalld.spec @@ -0,0 +1,253 @@ +Summary: A firewall daemon with D-Bus interface providing a dynamic firewall +Name: firewalld +Version: 1.0.0 +Release: 4%{?dist} +URL: http://www.firewalld.org +License: GPLv2+ +Source0: https://github.com/firewalld/firewalld/releases/download/v%{version}/firewalld-%{version}.tar.gz +Patch1: 0001-RHEL-only-Add-cockpit-by-default-to-some-zones.patch +Patch2: 0002-fix-firewalld-keep-linux-capability-CAP_SYS_MODULE.patch +Patch3: 0003-fix-firewalld-check-capng_apply-return-code.patch +BuildArch: noarch +BuildRequires: autoconf +BuildRequires: automake +BuildRequires: desktop-file-utils +BuildRequires: gettext +BuildRequires: intltool +# glib2-devel is needed for gsettings.m4 +BuildRequires: glib2, glib2-devel +BuildRequires: systemd-units +BuildRequires: docbook-style-xsl +BuildRequires: libxslt +BuildRequires: iptables, ebtables, ipset +BuildRequires: python3-devel +BuildRequires: make +Requires: iptables, ebtables, ipset +Requires(post): systemd +Requires(preun): systemd +Requires(postun): systemd +Requires: firewalld-filesystem = %{version}-%{release} +Requires: python3-firewall = %{version}-%{release} +Obsoletes: firewalld-selinux < 0.4.4.2-2 +Conflicts: selinux-policy < 3.14.1-28 +Conflicts: cockpit-ws < 173-2 +Recommends: libcap-ng-python3 + +%description +firewalld is a firewall service daemon that provides a dynamic customizable +firewall with a D-Bus interface. + +%package -n python3-firewall +Summary: Python3 bindings for firewalld + +%{?python_provide:%python_provide python3-firewall} + +Requires: python3-dbus +Requires: python3-gobject-base +Requires: python3-nftables + +%description -n python3-firewall +Python3 bindings for firewalld. + +%package -n firewalld-filesystem +Summary: Firewalld directory layout and rpm macros + +%description -n firewalld-filesystem +This package provides directories and rpm macros which +are required by other packages that add firewalld configuration files. + +%package -n firewall-applet +Summary: Firewall panel applet +Requires: %{name} = %{version}-%{release} +Requires: firewall-config = %{version}-%{release} +Requires: hicolor-icon-theme +Requires: python3-qt5-base +Requires: python3-gobject +Requires: libnotify +Requires: NetworkManager-libnm +Requires: dbus-x11 + +%description -n firewall-applet +The firewall panel applet provides a status information of firewalld and also +the firewall settings. + +%package -n firewall-config +Summary: Firewall configuration application +Requires: %{name} = %{version}-%{release} +Requires: hicolor-icon-theme +Requires: gtk3 +Requires: python3-gobject +Requires: NetworkManager-libnm +Requires: dbus-x11 +Recommends: polkit + +%description -n firewall-config +The firewall configuration application provides an configuration interface for +firewalld. + +%pretrans -p +-- HACK: Old rpm versions had an untracked (%ghost) symlink for +-- /etc/firewalld/firewalld.conf. RPM won't handle replacing the symlink due to +-- "%config(noreplace)". As such, we remove the symlink here before attempting +-- to install the new version which is a real file. Only replace the symlink if +-- the target matches one of the previous package's expected targets. +-- +-- Unfortunately this must be done in pretrans in order to occur before RPM +-- makes decisions about file replacement. +-- +local old_package_symlinks = {"firewalld-standard.conf", "firewalld-server.conf", + "firewalld-workstation.conf"} + +local symlink_target = posix.readlink("%{_sysconfdir}/firewalld/firewalld.conf") +for k,v in ipairs(old_package_symlinks) do + if symlink_target == v then + posix.unlink("%{_sysconfdir}/firewalld/firewalld.conf") + break + end +end + +%prep +%autosetup -p1 + +%build +%configure --enable-sysconfig --enable-rpmmacros PYTHON="%{__python3} %{py3_shbang_opts}" +make %{?_smp_mflags} + +%install +make install DESTDIR=%{buildroot} +desktop-file-install --delete-original \ + --dir %{buildroot}%{_sysconfdir}/xdg/autostart \ + %{buildroot}%{_sysconfdir}/xdg/autostart/firewall-applet.desktop +desktop-file-install --delete-original \ + --dir %{buildroot}%{_datadir}/applications \ + %{buildroot}%{_datadir}/applications/firewall-config.desktop + +install -d -m 755 %{buildroot}%{_prefix}/lib/firewalld/zones/ + +# remove unhandle firewalld-test subpackage +rm -rf %{buildroot}%{_datadir}/firewalld/testsuite + +%find_lang %{name} --all-name + +%post +%systemd_post firewalld.service + +%preun +%systemd_preun firewalld.service + +%postun +%systemd_postun_with_restart firewalld.service + +%files -f %{name}.lang +%doc COPYING README +%{_sbindir}/firewalld +%{_bindir}/firewall-cmd +%{_bindir}/firewall-offline-cmd +%dir %{_datadir}/bash-completion/completions +%{_datadir}/bash-completion/completions/firewall-cmd +%dir %{_datadir}/zsh/site-functions +%{_datadir}/zsh/site-functions/_firewalld +%{_prefix}/lib/firewalld/icmptypes/*.xml +%{_prefix}/lib/firewalld/ipsets/README +%{_prefix}/lib/firewalld/policies/*.xml +%{_prefix}/lib/firewalld/services/*.xml +%{_prefix}/lib/firewalld/zones/*.xml +%{_prefix}/lib/firewalld/helpers/*.xml +%attr(0750,root,root) %dir %{_sysconfdir}/firewalld +%config(noreplace) %{_sysconfdir}/firewalld/firewalld.conf +%config(noreplace) %{_sysconfdir}/firewalld/lockdown-whitelist.xml +%attr(0750,root,root) %dir %{_sysconfdir}/firewalld/helpers +%attr(0750,root,root) %dir %{_sysconfdir}/firewalld/icmptypes +%attr(0750,root,root) %dir %{_sysconfdir}/firewalld/ipsets +%attr(0750,root,root) %dir %{_sysconfdir}/firewalld/policies +%attr(0750,root,root) %dir %{_sysconfdir}/firewalld/services +%attr(0750,root,root) %dir %{_sysconfdir}/firewalld/zones +%defattr(0644,root,root) +%config(noreplace) %{_sysconfdir}/sysconfig/firewalld +%{_unitdir}/firewalld.service +%config(noreplace) %{_datadir}/dbus-1/system.d/FirewallD.conf +%{_datadir}/polkit-1/actions/org.fedoraproject.FirewallD1.desktop.policy.choice +%{_datadir}/polkit-1/actions/org.fedoraproject.FirewallD1.server.policy.choice +%{_datadir}/polkit-1/actions/org.fedoraproject.FirewallD1.policy +%{_mandir}/man1/firewall*cmd*.1* +%{_mandir}/man1/firewalld*.1* +%{_mandir}/man5/firewall*.5* +%{_sysconfdir}/modprobe.d/firewalld-sysctls.conf +%{_sysconfdir}/logrotate.d/firewalld + +%files -n python3-firewall +%attr(0755,root,root) %dir %{python3_sitelib}/firewall +%attr(0755,root,root) %dir %{python3_sitelib}/firewall/__pycache__ +%attr(0755,root,root) %dir %{python3_sitelib}/firewall/config +%attr(0755,root,root) %dir %{python3_sitelib}/firewall/config/__pycache__ +%attr(0755,root,root) %dir %{python3_sitelib}/firewall/core +%attr(0755,root,root) %dir %{python3_sitelib}/firewall/core/__pycache__ +%attr(0755,root,root) %dir %{python3_sitelib}/firewall/core/io +%attr(0755,root,root) %dir %{python3_sitelib}/firewall/core/io/__pycache__ +%attr(0755,root,root) %dir %{python3_sitelib}/firewall/server +%attr(0755,root,root) %dir %{python3_sitelib}/firewall/server/__pycache__ +%{python3_sitelib}/firewall/__pycache__/*.py* +%{python3_sitelib}/firewall/*.py* +%{python3_sitelib}/firewall/config/*.py* +%{python3_sitelib}/firewall/config/__pycache__/*.py* +%{python3_sitelib}/firewall/core/*.py* +%{python3_sitelib}/firewall/core/__pycache__/*.py* +%{python3_sitelib}/firewall/core/io/*.py* +%{python3_sitelib}/firewall/core/io/__pycache__/*.py* +%{python3_sitelib}/firewall/server/*.py* +%{python3_sitelib}/firewall/server/__pycache__/*.py* + +%files -n firewalld-filesystem +%dir %{_prefix}/lib/firewalld +%dir %{_prefix}/lib/firewalld/helpers +%dir %{_prefix}/lib/firewalld/icmptypes +%dir %{_prefix}/lib/firewalld/ipsets +%dir %{_prefix}/lib/firewalld/policies +%dir %{_prefix}/lib/firewalld/services +%dir %{_prefix}/lib/firewalld/zones +%{_rpmconfigdir}/macros.d/macros.firewalld + +%files -n firewall-applet +%{_bindir}/firewall-applet +%defattr(0644,root,root) +%{_sysconfdir}/xdg/autostart/firewall-applet.desktop +%dir %{_sysconfdir}/firewall +%{_sysconfdir}/firewall/applet.conf +%{_datadir}/icons/hicolor/*/apps/firewall-applet*.* +%{_mandir}/man1/firewall-applet*.1* + +%files -n firewall-config +%{_bindir}/firewall-config +%defattr(0644,root,root) +%{_datadir}/firewalld/firewall-config.glade +%{_datadir}/firewalld/gtk3_chooserbutton.py* +%{_datadir}/firewalld/gtk3_niceexpander.py* +%{_datadir}/applications/firewall-config.desktop +%{_datadir}/metainfo/firewall-config.appdata.xml +%{_datadir}/icons/hicolor/*/apps/firewall-config*.* +%{_datadir}/glib-2.0/schemas/org.fedoraproject.FirewallConfig.gschema.xml +%{_mandir}/man1/firewall-config*.1* + +%changelog +* Mon Nov 22 2021 Eric Garver - 1.0.0-4 +- fix(firewalld): check capng_apply() return code + +* Mon Nov 22 2021 Eric Garver - 1.0.0-3 +- fix(firewalld): keep linux capability CAP_SYS_MODULE + +* Mon Aug 09 2021 Mohan Boddu - 1.0.0-2 +- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags + Related: rhbz#1991688 + +* Mon Jul 26 2021 Eric Garver - 1.0.0-1 +- package rebase to v1.0.0 + +* Mon Jun 07 2021 Eric Garver - 1.0.0-0.3.alpha +- remove dead symlink (firewalld.conf) left over from old package versions + before installing new file + +* Tue Jun 01 2021 Eric Garver - 1.0.0-0.2.alpha +- fix missing policy kit symlink + +* Tue May 25 2021 Eric Garver - 1.0.0-0.1.alpha +- package rebase to v1.0.0-alpha