nftables, firewalld: add to runmode #725
Conversation
nftables is the modern packet filtering solution on Linux. The nftables userspace can be installed alongside iptables, but in general, only one can be enabled at once. This commit adds the userspace but does not do anything with the present iptables-based firewall configuration. At present, there are no plans to introduce nftables into safemode, so add it to the runmode packagegroup, not base. Signed-off-by: Rich Tollerton <[email protected]>
firewalld is the best-maintained high-level firewall administration tool on Linux. We ultimately wish to replace our present direct use of iptables (via initscript) with firewalld; but at present the existing configuration is unchanged. There are no plans at present to add firewalld to safemode. (Additionally, firewalld presently depends on nftables, which is also not going to be in safemode.) So add this specifically to runmode.
|
@gratian @amstewart lemme know what sort of bar you think is acceptable for disk size increases; I'm not sure if I'm OK with where I'm at right now. EDIT: Best I can offer on short notice is to cut the cairo bits out of python3-pygobject. Might be good for a meg? EDIT: Nope, no real size savings from |
|
New plan: nftables in runmode, firewalld in extras. |
|
We're only targeting SNAC OE changes to the RE: runmode sizes.
The extras/ feed is disabled in the SNAC configuration. We can only install packages from feeds that we "officially support" - so the core feed. |
|
New branch so new PR; closing in lieu of a PR to be created soon. |
2 participants
Summary of Changes
Add nftables (modern Linux packet filtering support) and firewalld (modern Linux high-level firewall administration tool) packages to runmode. At present, neither will be enabled, but they can be enabled by the user. The existing iptables initscript is unchanged. This is tracked by Azure DevOps workitem AB#2823118.
Testing
Built nilrt-base-system-image and confirmed it runs on a VM. nft runs; iptables still runs. firewall-cmd is not yet tested.
This change will grow the uncompressed BSI by approximately 9.5MB (!). The largest new files break down along the following lines:
Several things about this seem problematic.
firewall-config; we don't need it, but if we need GTK3 anyway, I guess it can't hurt.I fear the gobject-related bits will be hard to remove; they've been in firewalld since 2012. That said, the only thing I can find so far that clearly requires it is DBus (?). I think I'm missing something.
bitbake packagefeed-ni-core)Procedure