From 8a520d8343ab1567f0f3df39e4fc45dbaf9c6f77 Mon Sep 17 00:00:00 2001 From: Eric Garver Date: Thu, 24 Sep 2020 15:24:41 -0400 Subject: [PATCH 60/62] docs(firewall-cmd): clarify lockdown whitelist command paths Reported-by: D. Hugh Redelmeier (cherry picked from commit a7b12b8eb87dd3bd2bb342cf5d74bf089cf3b9a6) (cherry picked from commit 7e9b1a02cc7aa12f9c499b2acad584dbabf9a518) --- doc/xml/firewall-cmd.xml.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/xml/firewall-cmd.xml.in b/doc/xml/firewall-cmd.xml.in index 8bc389acae6c..702c549ab9d9 100644 --- a/doc/xml/firewall-cmd.xml.in +++ b/doc/xml/firewall-cmd.xml.in @@ -2104,7 +2104,7 @@ For interfaces that are not under control of NetworkManager, firewalld tries to If a command entry on the whitelist ends with an asterisk '*', then all command lines starting with the command will match. If the '*' is not there the absolute command inclusive arguments must match. - Commands for user root and others is not always the same. Example: As root /bin/firewall-cmd is used, as a normal user /usr/bin/firewall-cmd is be used on Fedora. + Command paths for users are not always the same and depends on the users PATH. Some distributions symlink /bin to /usr/bin in which case it depends on the order they appear in the PATH environment variable. The context is the security (SELinux) context of a running application or service. To get the context of a running application use ps -e --context. -- 2.28.0