Hi Marc,
On 2026-07-23 23:40, Marc Haber wrote:
> Control: tags -1 confirmed
> thanks
>
> Hi Aurelien,
>
> thank you for using ferm and my apologies for the problems you have.
>
> Witout having plunged into the issue deeply yet,
>
> On Wed, Jul 22, 2026 at 12:30:11AM +0200, Aurelien Jarno wrote:
> > There is an obvious dash missing before "-shell" in
> > /usr/libexec/ferm/ferm-systemd activate, but unfortunately adding it is
> > not enough to fix the issue.
>
> The problem is that the DEBUG stanza was pasted in between the two
> dashes of --shell, so you'd need to remove the - before the ${DEBUG
> part.
>
> Does that fix your issue already?
It makes things better, but there are still more issues, introduced by
patches 0009-add-verbose-option-for-bette-debugging.patch and
0011-better-debug-output-regarding-flie-open.patch:
juil. 26 14:29:35 scratch ferm-systemd[3861]: Cache generated successfully. Now
using fresh cache to activate rules
juil. 26 14:29:35 scratch ferm-systemd[3872]:
/var/cache/ferm/-etc-ferm-ferm.conf.sh: line 1: piping: command not found
juil. 26 14:29:35 scratch ferm-systemd[3873]:
/var/cache/ferm/-etc-ferm-ferm.conf.sh: line 2: piping: command not found
juil. 26 14:29:35 scratch ferm-systemd[3861]:
/var/cache/ferm/-etc-ferm-ferm.conf.sh: line 24: syntax error near unexpected
token `running'
juil. 26 14:29:35 scratch ferm-systemd[3861]:
/var/cache/ferm/-etc-ferm-ferm.conf.sh: line 24: `running
/usr/sbin/iptables-restore for restore'
At the end the patch below is enough to get ferm starting, but I am not
sure about the fix to the ferm binary, nor I am not sure it fixes all
the cases.
Regards
Aurelien
--- /usr/libexec/ferm/ferm-systemd
+++ /usr/libexec/ferm/ferm-systemd
@@ -138,7 +138,7 @@
echo "Regenerating ferm cache... ${FERM} ${OPTIONS}
${DEBUG:+--lines --verbose} --shell ${CONFIG} to ${CACHE_FILE}.tmp"
rm -f "${CACHE_FILE}" "${CACHE_FILE}.tmp" "${KERNEL_FILE}"
- "${FERM}" ${OPTIONS} -${DEBUG:+--lines --verbose} -shell
"${CONFIG}" > "${CACHE_FILE}.tmp" || return $?
+ "${FERM}" ${OPTIONS} ${DEBUG:+--lines --verbose} --shell
"${CONFIG}" > "${CACHE_FILE}.tmp" || return $?
cp /proc/version "${KERNEL_FILE}"
mv "${CACHE_FILE}.tmp" "${CACHE_FILE}" || return $?
--- /usr/sbin/ferm
+++ /usr/sbin/ferm
@@ -986,7 +986,7 @@
} elsif (exists $tools{'tables-save'} &&
open(SAVE, "$tools{'tables-save'}|")) {
# for rollback
- print LINES "piping to tools tables-save: ". $tools{'tables-save'}.
"\n";
+ print LINES "# piping to tools tables-save: ". $tools{'tables-save'}.
"\n";
$domain_info->{previous} = read_previous(\*SAVE, $domain_info);
}
@@ -3140,7 +3140,7 @@
$path .= " --noflush" if $option{noflush};
local *RESTORE;
- print LINES "running $path for restore\n";
+ print LINES "# running $path for restore\n";
open RESTORE, "|$path"
or die "Failed to run $path: $!\n";
@@ -3168,7 +3168,7 @@
return if $option{noexec};
eval {
- print LINES "restore_domain()\n"
+ print LINES "# restore_domain()\n"
if $option{lines};
restore_domain($domain_info, $save);
};
--
Aurelien Jarno GPG: 4096R/1DDD8C9B
[email protected] http://aurel32.net
