On 2017-01-03 14:31, Tom H wrote:
On Tue, Jan 3, 2017 at 3:11 PM, jdow <[email protected]> wrote:
On 2017-01-03 09:56, David Sommerseth wrote:
Remember that firewalld provides an API over D-Bus for dynamic
firewall updates, so this is kind of to "seal" the configuration
without breaking any component depending on manipulating the firewall
as the system is running. NetworkManager and libvirt are two
components which adjusts the firewall on-the-fly, depending on which
network you're connected to or which VMs have been started, and so on.
That still leaves me mumbling and led me down a midget rabbit hole.
The "iptables" command is 777 root root system_u:object_r:bin_t:s0;
but, that's OK. It's a link - to xtables-multi, which is rwxr-xr-x.
root root system_u:object_r:iptables_exec_t:s0. Waitaminit says I to
meself. (or is it me to iself? Whatever) Let's give that a try.... The
results are reassuring:
===8<---
[jdow@whereever ~]$ xtables-multi iptables -L -v
iptables v1.4.21: can't initialize iptables table `filter': Permission
denied (you must be root)
Perhaps iptables or your kernel needs to be upgraded.
===8<---
I guess the ancient philosophy of one task one command is passe' and
now a monstrosity like xtables-multi finds itself masquerading as
iptables and about a dozen other things.
/usr/sbin/iptables-restore
/usr/sbin/iptables-save
/usr/sbin/iptables
/usr/sbin/ip6tables-restore
/usr/sbin/ip6tables-save
/usr/sbin/ip6tables
Notice the command I issued. I started, of course, with something like
xtables-multi -L -v as a first approximation. It coughed up a list of some 14
different things it can be called as. That was not reassuring since I called it
as a user rather than root. Then I tried the command listed. If failed but the
message was informative enough. I, of course, escalated to prepending "sudo " to
the command, giving my password as usual, and admired the results.
are symlinks to "/usr/sbin/xtables-multi" because it's a multi-call
binary, like busybox.
I was simply bemused that the old UNIX philosophy of one small task one command
with results chained into the next command ad nauseum has finally been
discovered to be silly and furthermore good sense is catching on past busybox.
(I have the same attitude about "goto". (And despite dogma even at UniSys many
see Dijkstra's pontification on the subject as flawed er and harmful. I live
with one such.) {^_-}
There are others.
Off the top of my head, dnsdomainname, domainname, nisdomainname,
ypdomainname are symlinks to hostname; halt, poweroff, reboot,
shutdown are symlinks to systemctl; view is a symlink to vi; etc.
I hadn't dug that far. But, again, it makes sense in a weird sort of way. It is
really an ultimate reuse of code, right? {^_-}
It's normal for "iptables" to fail if you call it as jdow; but if you
have polkit installed, "pkexec iptables" might work (depending on your
polkit policies; "sudo ..." and "su -c ..." will work if you're
authorized).
But of course. I've been using sudo for a very long time. (I don't remember if I
did it with the real SVR4 machine I had. But certainly I've been using it from
the first RH 5 or so - not RHEL or Fedora, Hurricane if my memory works tonight.
If sudo didn't work I'd have made a scene about it, probably.
{^_^}
