Comments (3)
The NetworkManager configuration should be performed in the firewall Python module, not just as part of the CLI script, as the issue is not specific to the CLI.
The nuance here is polkit authorization. If the request is done by the firewalld daemon, then it's not representative of the user making the request via firewall-cmd (or ansible). This means NetworkManager can't apply any reasonable policy for modifying the connections (ZONE
) setting; it would always appear to come from the user firewalld runs as, i.e. root
.
My guess is the above is why it's done by the UI and not the daemon.
So the question becomes, does it make sense to allow firewalld
the daemon to modify NetworkManager's connection profiles. It may side-step NM's existing polkit policies.
I'm not sure it makes sense for firewalld (client or daemon) to forward these requests to NM on behalf of the user. It would be better to configure them through NetworkManager directly, but then users are confused because NM will alter the interface to zone assignment at runtime; overriding firewalld's own configuration. This NM integration has been in firewalld for a long time. We can't just drop it.
@thom311, any thoughts?
from firewalld.
Is it possible to run the firewall Python module without root access? If not, I don't see a reason why firewalld wouldn't go through with the changes at library level, instead of CLI level, since in the end the result would be the same, as you'd still have to run the firewalld commands as root. You also wouldn't violate NetworkManager's polkit policies, since they cannot offer capabilities that root does not have (as far as I know, there might be some niche interactions in SELinux or other other security modules).
from firewalld.
Is it possible to run the firewall Python module without root access?
Yes. It's possible to specify and customize the polkit authorization. In practice (default) config changes require root, but they don't have to.
from firewalld.
Related Issues (20)
- Unfriendly error message with `firewall-cmd --load-zone-defaults` without customization.
- Feature request: Add a functionality for services/ports/protocols to be filtered first and then source IP HOT 2
- PolicyKit authentication attempt on startup of firewall-config times out after 25 seconds HOT 10
- Ceph highest port number is outdated
- usability: default target is not shown on zone-info HOT 4
- firewall-offline-cmd fails to enable/disable lockdown HOT 1
- DB connection fails with port 5432 with docker HOT 11
- Entry check fails for IP sets combining CIDRs and ranges HOT 1
- firewalld reload/restart flushes tables not part of firewalld rules on version: 0.9.11 HOT 4
- Firewalld fails to load IP sets with overlapping entries HOT 2
- Firewalld goes into a failed state when adding overlapping intervals as IP set entries
- document icmp reject types in manpage firewalld.richlanguage
- firewall-config brings up INVALID_ZONE dialog for combined zones
- Using "firewall-cmd --direct" flushes existing rules. HOT 1
- Dumping current firewall as firewall-cmds HOT 1
- Network queues in firewalld HOT 1
- public.xml not restricting by source address HOT 10
- List all active zones HOT 2
- [firewalld 2.2.0] testsuite: 207 failed HOT 9
- Incompatibilities with nftables 1.1.0 (ERROR: COMMAND_FAILED: 'python-nftables' failed) HOT 37
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from firewalld.