On Sun, 2011-07-31 at 06:48 -0700, Tom Eastep wrote: > On Sun, 2011-07-31 at 06:35 -0700, Tom Eastep wrote: > > On Sun, 2011-07-31 at 06:48 +0000, Andrew Silverman wrote: > > > > > I am setting up a shorewall6-only config to firewall my HE tunnel. The > > > system is a CentOS 6.0 VM (running on Hyper-V but that's not the problem > > > here.) > > > > > > Shorewall6 runs just fine when I "su" and then launch it manually with > > > "shorewall6 start" - no problems, everything behaves exactly as intended, > > > and all the firewall behavior is exactly as I want it to be. So with all > > > that initial config taken care of (much experimentation required) I moved > > > on to trying to get it to start at boot automatically. > > > > > > However, when I try to launch it instead by putting shorewall6 start into > > > /etc/rc.d/rc.local, it fails, and the log only shows me this: > > > > > > [root@ipv6tunl log]# more shorewall6-init.log > > > Jul 30 23:38:10 Processing /etc/shorewall6/params ... > > > Jul 30 23:38:10 ERROR: Processing of /etc/shorewall6/params failed > > > > > > And that's it - nothing else in the log. I tried changing the start line > > > to do tracing to /tmp/trace, but the trace came up empty, so at the > > > moment I am clueless as to why it won't start properly at boot time. > > > > > > FYI, the reason I'm starting it this way rather than by chkconfig is so > > > that I can force a few ip commands to complete first to configure the HE > > > 6in4 tunnel first before starting the firewall that relies on the tunnel > > > being running. > > > > > > Totally open to suggestions, or what more troubleshooting/logging I can > > > provide - NOT a Linux expert, but learning fast. > > > > What are the contents of /etc/shorewall6/params? > > > > Also, which version of Shorewall6 are you running?
I've reproduced the problem. It is an SELinux issue whereby a script
in /etc/init.d is not permitted to
execute /usr/share/shorewall/getparams. You can reproduce the failure by
simply typing:
/etc/init.d/shorewall6 start
Hopefully someone with more SELinux foo than I have (which is none) can
give you advice.
-Tom
--
Tom Eastep \ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \________________________________________________
signature.asc
Description: This is a digitally signed message part
------------------------------------------------------------------------------ Got Input? Slashdot Needs You. Take our quick survey online. Come on, we don't ask for help often. Plus, you'll get a chance to win $100 to spend on ThinkGeek. http://p.sf.net/sfu/slashdot-survey
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
