Bug 5894 - configureNetwork install iptables/shorewall despite having been previously deselected
Summary: configureNetwork install iptables/shorewall despite having been previously de...
Status: NEW
Alias: None
Product: Mageia
Classification: Unclassified
Component: Installer (show other bugs)
Version: Cauldron
Hardware: All Linux
Priority: Low minor
Target Milestone: ---
Assignee: Mageia tools maintainers
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-05-14 05:03 CEST by Felix Miata
Modified: 2016-10-12 14:24 CEST (History)
4 users (show)

See Also:
Source RPM:
CVE:
Status comment:


Attachments
/root/drakx .tgz (418.75 KB, application/octet-stream)
2012-05-14 05:03 CEST, Felix Miata
Details

Description Felix Miata 2012-05-14 05:03:37 CEST
Created attachment 2301 [details]
/root/drakx .tgz

To reproduce:
1-select minimal install with individual package selection
2-deselect iptables

Actual results:
1-iptables and shorewall are installed

Expected results
2-neither iptables nor shorewall get installed

IIRC this goes years back on Mandriva, so nothing new. I've done several installs in recent weeks, and always these are installed.
Comment 1 Marja Van Waes 2012-05-26 13:10:01 CEST
Hi,

This bug was filed against cauldron, but we do not have cauldron at the moment.

Please report whether this bug is still valid for Mageia 2.

Thanks :)

Cheers,
marja

Keywords: (none) => NEEDINFO

Comment 2 Felix Miata 2012-05-26 15:25:34 CEST
According to the mirror I checked there is too a Cauldron.

A name change of a nominally changed release doesn't magically make a bug go away. And, one must do an installation to confirm the problem. I'm not going to do another installation simply to confirm a many years old bug when the bug owner hasn't done anything with it in the mere two weeks since it was filed.

Keywords: NEEDINFO => (none)
Version: Cauldron => 2

Comment 3 Manuel Hiebel 2012-05-27 17:39:08 CEST
no worry, the ping was to a lot a bugs, but some exclude was missing (like exclude the recent bugs near to the release freeze)
Comment 4 Samuel Verschelde 2013-08-27 13:12:08 CEST
1. Changing version to cauldron since we can't fix installer for released versions (that's what alphas and betas are for)
2. Is this bug still valid with latest installer? (Mageia 4 alpha 1 as of today)

Version: 2 => Cauldron

Samuel Verschelde 2013-08-27 13:12:33 CEST

Keywords: (none) => NEEDINFO
CC: (none) => stormi

Comment 5 Felix Miata 2013-08-28 02:27:59 CEST
This is what's installed after unchecking the iptables and shorewall boxes doing HTTP install of x86_64 Cauldron from mirrors.us.kernel.org using 22 Aug. installation kernel and initrd from alt0, with all non-default installation source checkboxes checked:
iptables-1.4.20-1.mga4
lib64iptables10-1.4.20-1.mga4
lib64x264_133-0.133-0.20130823.stable.1.mga4.tainted
shorewall-4.5.10.1-5.mga4
shorewall-core-4.5.10.1-5.mga4
shorewall-ipv6-4.5.10.1-5.mga4

Subsequently running:
urpme iptables lib64iptables10 lib64x264_133
does not list shorewall-core among packages to be removed, and does list
lib64-alsa-plugins, and
lib64-avcodec55
among packages to be removed.

What do lib64-alsa-plugins and lib64-avcodec55 have to do with iptables or shorewall? Maybe this is why $SUMMARY?

Keywords: NEEDINFO => (none)

Comment 6 Samuel Verschelde 2013-08-28 09:31:10 CEST
Ok, then this would be more a packaging issue than an installer issue. Let's see if alsa-plugins' maintainer has any insight to give us :)

Keywords: (none) => Triaged
Assignee: bugsquad => mageia
Source RPM: (none) => alsa-plugins

Comment 7 Felix Miata 2013-08-28 09:56:51 CEST
On rereading my comment 5, lib64x264_133 shouldn't have been listed, and therefore I shouldn't have tried urpme on it, which is what wanted to uninstall the two audio libs. The only relationship between iptables* and the 3 audio libs is the string "table" in the x264 A/V package's name.
Comment 8 Samuel Verschelde 2013-08-28 10:04:40 CEST
ok, back to installer then :)

Assignee: mageia => bugsquad
Source RPM: alsa-plugins => (none)

Comment 9 Dick Gevers 2014-11-17 15:29:29 CET
Triage did not correct assignee. Now it is kinda old.

Needs retesting and proper assignment per current installer (5beta1 these days).

Keywords: Triaged => NEEDINFO

Comment 10 Thierry Vignaud 2015-06-02 15:22:02 CEST
This ie due to the call to network::drakfirewall::set_ports(() from install::steps::configure_firewall(), itself being called from configureNetwork():
http://gitweb.mageia.org/software/drakx/tree/perl-install/install/steps.pm#n641

We automatically configure a firewall since this commit:
http://gitweb.mageia.org/software/drakx/commit/?id=9f332be09e
"configure a firewall by default in secure level >= 3"

The bug being one cannot alter the security level before summary since quite some time.
On the other hand we do want to setup a firewall by default for our users.
I suggest adding a "nofirewall" option to drakx.

WDYT?

Keywords: NEEDINFO => (none)
Priority: Normal => Low
CC: (none) => mageia, thierry.vignaud
Summary: deselection of iptables/shorewall never persists => configureNetwork install iptables/shorewall despite having been previously deselected
Severity: normal => minor

Comment 11 Marja Van Waes 2016-02-08 09:27:00 CET
(In reply to Thierry Vignaud from comment #10)

<snip>
> I suggest adding a "nofirewall" option to drakx.
> 
> WDYT?

@ Felix

can you please reply?

It sounds fine to me, but I won't ever use the option, and you own this bug report ;-)

Keywords: (none) => NEEDINFO
CC: (none) => marja11

Comment 12 Felix Miata 2016-02-08 09:50:10 CET
Why doesn't the NEEDINFO keyword somehow specify who it is that info is expected from, like in other bug trackers that use the term?

As I use a dedicated firewall, I don't litter workstation or test installations with software that lengthens update processes, complicates testing, and consumes filesystem space needlessly whereever I have the choice. Normally I install minimal, then add what I need with urpmi. I'd much rather add than need to subtract. IMO, firewall ought not be part of a minimal install, so a startup option shouldn't be needed, but if an option is the only way to not have what isn't wanted or needed it will be better than nothing.
Comment 13 Marja Van Waes 2016-02-08 10:26:11 CET
(In reply to Felix Miata from comment #12)
> Why doesn't the NEEDINFO keyword somehow specify who it is that info is
> expected from, like in other bug trackers that use the term?

I wasn't aware other bug trackers did that, but just asked about it in #mageia-bugsquad on freenode... you might want to join that channel if you're curious whether anyone replies

Keywords: NEEDINFO => (none)

Thierry Vignaud 2016-07-12 01:49:59 CEST

Hardware: i586 => All

Samuel Verschelde 2016-10-12 14:24:32 CEST

Assignee: bugsquad => mageiatools


Note You need to log in before you can comment on or make changes to this bug.