|
 |
87a48e |
From 1aef58a8ff6d232cefcc6bd19ea63c0f071bfee3 Mon Sep 17 00:00:00 2001
|
|
|
87a48e |
From: Eric Garver <egarver@redhat.com>
|
|
|
87a48e |
Date: Mon, 20 Dec 2021 13:56:55 -0500
|
|
|
87a48e |
Subject: [PATCH 48/48] RHEL only: default to CleanupModulesOnExit=yes
|
|
|
87a48e |
|
|
|
87a48e |
Resolves: rhbz1980206
|
|
|
87a48e |
---
|
|
|
87a48e |
config/firewalld.conf | 4 ++--
|
|
|
87a48e |
doc/xml/firewalld.conf.xml | 4 ++--
|
|
|
87a48e |
src/firewall/config/__init__.py.in | 2 +-
|
|
|
87a48e |
src/firewall/core/fw.py | 2 ++
|
|
|
87a48e |
src/tests/dbus/firewalld.conf.at | 4 ++--
|
|
|
87a48e |
5 files changed, 9 insertions(+), 7 deletions(-)
|
|
|
87a48e |
|
|
|
87a48e |
diff --git a/config/firewalld.conf b/config/firewalld.conf
|
|
|
87a48e |
index 3abbc9c998c1..c387f87c28be 100644
|
|
|
87a48e |
--- a/config/firewalld.conf
|
|
|
87a48e |
+++ b/config/firewalld.conf
|
|
|
87a48e |
@@ -15,8 +15,8 @@ CleanupOnExit=yes
|
|
|
87a48e |
# If set to yes or true the firewall related kernel modules will be
|
|
|
87a48e |
# unloaded on exit or stop of firewalld. This might attempt to unload
|
|
|
87a48e |
# modules not originally loaded by firewalld.
|
|
|
87a48e |
-# Default: no
|
|
|
87a48e |
-CleanupModulesOnExit=no
|
|
|
87a48e |
+# Default: yes
|
|
|
87a48e |
+CleanupModulesOnExit=yes
|
|
|
87a48e |
|
|
|
87a48e |
# Lockdown
|
|
|
87a48e |
# If set to enabled, firewall changes with the D-Bus interface will be limited
|
|
|
87a48e |
diff --git a/doc/xml/firewalld.conf.xml b/doc/xml/firewalld.conf.xml
|
|
|
87a48e |
index dd6ffb214eb3..12d9f5fc563e 100644
|
|
|
87a48e |
--- a/doc/xml/firewalld.conf.xml
|
|
|
87a48e |
+++ b/doc/xml/firewalld.conf.xml
|
|
|
87a48e |
@@ -93,8 +93,8 @@
|
|
|
87a48e |
<listitem>
|
|
|
87a48e |
<para>
|
|
|
87a48e |
Setting this option to yes or true unloads all firewall-related
|
|
|
87a48e |
- kernel modules when firewalld is stopped. The default value is no
|
|
|
87a48e |
- or false.
|
|
|
87a48e |
+ kernel modules when firewalld is stopped. The default value is yes
|
|
|
87a48e |
+ or true.
|
|
|
87a48e |
</para>
|
|
|
87a48e |
</listitem>
|
|
|
87a48e |
</varlistentry>
|
|
|
87a48e |
diff --git a/src/firewall/config/__init__.py.in b/src/firewall/config/__init__.py.in
|
|
|
87a48e |
index 5d6d769fbf15..285e2f034b6b 100644
|
|
|
87a48e |
--- a/src/firewall/config/__init__.py.in
|
|
|
87a48e |
+++ b/src/firewall/config/__init__.py.in
|
|
|
87a48e |
@@ -125,7 +125,7 @@ FIREWALL_BACKEND_VALUES = [ "nftables", "iptables" ]
|
|
|
87a48e |
FALLBACK_ZONE = "public"
|
|
|
87a48e |
FALLBACK_MINIMAL_MARK = 100
|
|
|
87a48e |
FALLBACK_CLEANUP_ON_EXIT = True
|
|
|
87a48e |
-FALLBACK_CLEANUP_MODULES_ON_EXIT = False
|
|
|
87a48e |
+FALLBACK_CLEANUP_MODULES_ON_EXIT = True
|
|
|
87a48e |
FALLBACK_LOCKDOWN = False
|
|
|
87a48e |
FALLBACK_IPV6_RPFILTER = True
|
|
|
87a48e |
FALLBACK_INDIVIDUAL_CALLS = False
|
|
|
87a48e |
diff --git a/src/firewall/core/fw.py b/src/firewall/core/fw.py
|
|
|
87a48e |
index 4171697bdb94..5cef18b5f889 100644
|
|
|
87a48e |
--- a/src/firewall/core/fw.py
|
|
|
87a48e |
+++ b/src/firewall/core/fw.py
|
|
|
87a48e |
@@ -238,6 +238,8 @@ class Firewall(object):
|
|
|
87a48e |
value = self._firewalld_conf.get("CleanupModulesOnExit")
|
|
|
87a48e |
if value is not None and value.lower() in [ "yes", "true" ]:
|
|
|
87a48e |
self.cleanup_modules_on_exit = True
|
|
|
87a48e |
+ if value is not None and value.lower() in [ "no", "false" ]:
|
|
|
87a48e |
+ self.cleanup_modules_on_exit = False
|
|
|
87a48e |
log.debug1("CleanupModulesOnExit is set to '%s'",
|
|
|
87a48e |
self.cleanup_modules_on_exit)
|
|
|
87a48e |
|
|
|
87a48e |
diff --git a/src/tests/dbus/firewalld.conf.at b/src/tests/dbus/firewalld.conf.at
|
|
|
87a48e |
index 9a04a3bd491c..68832bca33bc 100644
|
|
|
87a48e |
--- a/src/tests/dbus/firewalld.conf.at
|
|
|
87a48e |
+++ b/src/tests/dbus/firewalld.conf.at
|
|
|
87a48e |
@@ -17,7 +17,7 @@ dnl Verify defaults over dbus. Should be inline with default firewalld.conf.
|
|
|
87a48e |
DBUS_GETALL([config], [config], 0, [dnl
|
|
|
87a48e |
string "AllowZoneDrifting" : variant string "no"
|
|
|
87a48e |
string "AutomaticHelpers" : variant string "no"
|
|
|
87a48e |
-string "CleanupModulesOnExit" : variant string "no"
|
|
|
87a48e |
+string "CleanupModulesOnExit" : variant string "yes"
|
|
|
87a48e |
string "CleanupOnExit" : variant string "no"
|
|
|
87a48e |
string "DefaultZone" : variant string "public"
|
|
|
87a48e |
string "FirewallBackend" : variant string "nftables"
|
|
|
87a48e |
@@ -46,7 +46,7 @@ _helper([IPv6_rpfilter], [string:"yes"], [variant string "yes"])
|
|
|
87a48e |
_helper([IndividualCalls], [string:"yes"], [variant string "yes"])
|
|
|
87a48e |
_helper([FirewallBackend], [string:"iptables"], [variant string "iptables"])
|
|
|
87a48e |
_helper([FlushAllOnReload], [string:"no"], [variant string "no"])
|
|
|
87a48e |
-_helper([CleanupModulesOnExit], [string:"yes"], [variant string "yes"])
|
|
|
87a48e |
+_helper([CleanupModulesOnExit], [string:"no"], [variant string "no"])
|
|
|
87a48e |
_helper([CleanupOnExit], [string:"yes"], [variant string "yes"])
|
|
|
87a48e |
_helper([RFC3964_IPv4], [string:"no"], [variant string "no"])
|
|
|
87a48e |
_helper([AllowZoneDrifting], [string:"yes"], [variant string "yes"])
|
|
|
87a48e |
--
|
|
|
87a48e |
2.31.1
|
|
|
87a48e |
|