From d06f9c69a6dcd24ae6539c988a4632089b9aafd0 Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Jan 11 2022 18:43:06 +0000 Subject: import firewalld-1.0.0-4.el9 --- diff --git a/SOURCES/0002-fix-firewalld-keep-linux-capability-CAP_SYS_MODULE.patch b/SOURCES/0002-fix-firewalld-keep-linux-capability-CAP_SYS_MODULE.patch new file mode 100644 index 0000000..714e43d --- /dev/null +++ b/SOURCES/0002-fix-firewalld-keep-linux-capability-CAP_SYS_MODULE.patch @@ -0,0 +1,54 @@ +From 09cdc166ddfe53b6e8ce3a2920f798320c170b7f Mon Sep 17 00:00:00 2001 +From: Eric Garver +Date: Wed, 11 Aug 2021 14:47:59 -0400 +Subject: [PATCH 2/3] fix(firewalld): keep linux capability CAP_SYS_MODULE + +When firewalld calls ip6tables it may implicitly load the ip6_tables, et +al kernel modules. As such we need to retain CAP_SYS_MODULE so that +implicit module is allowed. Otherwise we get EPERM from the kernel. + +This only affects the -legacy variants and the top level table/chain +modules. The userspace binaries will modprobe the kernel modules. +Extensions, e.g. xt_conntrack, are implicitly loaded by the kernel based +on the rules being added and thus not subject to linux capabilities +checks. + +The -nft variants are unaffected because they use the nftables +infrastructure which has implicit module loading in the kernel similar +to the iptables extensions (xt_* modules). + +Fixes: rhbz 1990271 +Fixes: fb0532e8a200 ("feat(firewalld): drop linux capabilities") +(cherry picked from commit 13801962073f478c68d818b314091badcf8b5614) +(cherry picked from commit d3cd7e088f946c75593b0569bd658266b2e9329d) +--- + src/firewalld.in | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/src/firewalld.in b/src/firewalld.in +index abcbe3508f86..b1c886c6f02f 100755 +--- a/src/firewalld.in ++++ b/src/firewalld.in +@@ -136,6 +136,7 @@ def startup(args): + # attempt to drop Linux capabilities to a minimal set: + # - CAP_NET_ADMIN + # - CAP_NET_RAW ++ # - CAP_SYS_MODULE + try: + import capng + capng.capng_clear(capng.CAPNG_SELECT_BOTH) +@@ -143,8 +144,10 @@ def startup(args): + capng.CAP_NET_ADMIN) + capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET, + capng.CAP_NET_RAW) ++ capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET, ++ capng.CAP_SYS_MODULE) + capng.capng_apply(capng.CAPNG_SELECT_BOTH) +- log.info(log.INFO1, "Dropped Linux capabilities to NET_ADMIN, NET_RAW.") ++ log.info(log.INFO1, "Dropped Linux capabilities to NET_ADMIN, NET_RAW, SYS_MODULE.") + except ImportError: + pass + +-- +2.31.1 + diff --git a/SOURCES/0003-fix-firewalld-check-capng_apply-return-code.patch b/SOURCES/0003-fix-firewalld-check-capng_apply-return-code.patch new file mode 100644 index 0000000..b93f0ea --- /dev/null +++ b/SOURCES/0003-fix-firewalld-check-capng_apply-return-code.patch @@ -0,0 +1,48 @@ +From 4a627847d36afedfca20026fb763fbb71005b92f Mon Sep 17 00:00:00 2001 +From: Eric Garver +Date: Mon, 30 Aug 2021 13:24:47 -0400 +Subject: [PATCH 3/3] fix(firewalld): check capng_apply() return code + +If dropping capabilities is blocked by SELinux, e.g. old selinux-policy, +then capng_apply() will return non-zero. Also check other things that +may fail, i.e. capng_update(). + +Fixes: rhbz 1999090 +(cherry picked from commit 36749f512bbcfc55f0e9e46354009073941d7363) +(cherry picked from commit cf7f3320c78a8b3f2b8f22779c5747f113d25c57) +--- + src/firewalld.in | 18 ++++++++++-------- + 1 file changed, 10 insertions(+), 8 deletions(-) + +diff --git a/src/firewalld.in b/src/firewalld.in +index b1c886c6f02f..38331a0b49a9 100755 +--- a/src/firewalld.in ++++ b/src/firewalld.in +@@ -140,14 +140,16 @@ def startup(args): + try: + import capng + capng.capng_clear(capng.CAPNG_SELECT_BOTH) +- capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET, +- capng.CAP_NET_ADMIN) +- capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET, +- capng.CAP_NET_RAW) +- capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET, +- capng.CAP_SYS_MODULE) +- capng.capng_apply(capng.CAPNG_SELECT_BOTH) +- log.info(log.INFO1, "Dropped Linux capabilities to NET_ADMIN, NET_RAW, SYS_MODULE.") ++ if capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET, ++ capng.CAP_NET_ADMIN) or \ ++ capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET, ++ capng.CAP_NET_RAW) or \ ++ capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET, ++ capng.CAP_SYS_MODULE) or \ ++ capng.capng_apply(capng.CAPNG_SELECT_BOTH): ++ log.info(log.INFO1, "libcap-ng failed to drop Linux capabilities.") ++ else: ++ log.info(log.INFO1, "Dropped Linux capabilities to NET_ADMIN, NET_RAW, SYS_MODULE.") + except ImportError: + pass + +-- +2.31.1 + diff --git a/SPECS/firewalld.spec b/SPECS/firewalld.spec index 353b48c..1245be3 100644 --- a/SPECS/firewalld.spec +++ b/SPECS/firewalld.spec @@ -1,11 +1,13 @@ Summary: A firewall daemon with D-Bus interface providing a dynamic firewall Name: firewalld Version: 1.0.0 -Release: 2%{?dist} +Release: 4%{?dist} URL: http://www.firewalld.org License: GPLv2+ Source0: https://github.com/firewalld/firewalld/releases/download/v%{version}/firewalld-%{version}.tar.gz Patch1: 0001-RHEL-only-Add-cockpit-by-default-to-some-zones.patch +Patch2: 0002-fix-firewalld-keep-linux-capability-CAP_SYS_MODULE.patch +Patch3: 0003-fix-firewalld-check-capng_apply-return-code.patch BuildArch: noarch BuildRequires: autoconf BuildRequires: automake @@ -227,6 +229,12 @@ rm -rf %{buildroot}%{_datadir}/firewalld/testsuite %{_mandir}/man1/firewall-config*.1* %changelog +* Mon Nov 22 2021 Eric Garver - 1.0.0-4 +- fix(firewalld): check capng_apply() return code + +* Mon Nov 22 2021 Eric Garver - 1.0.0-3 +- fix(firewalld): keep linux capability CAP_SYS_MODULE + * Mon Aug 09 2021 Mohan Boddu - 1.0.0-2 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688