Well, thanks for identifying the problem at least! - I'll do some digging on the web and see if anything presents itself, but otherwise hopefully someone on the list will have a clue. Do you have any particular suggestions for a workaround?
All I really need is to make sure I can get the tunnel params configured before shorewall6 launches... I first tried to do this by creating a script to run from init.d with chkconfig before shorewall6 launches, but it seems to have the same problem there and moving it to rc.local didn't cure it - initially I thought it was a chkconfig load ordering problem. So I guess now the problem is how to launch it at all without doing it interactively from a su prompt? Not that it matters at this point, but there's nothing at all in the params file other than the comments lines, I didn't edit it, and I'm running the latest 4.4.21-1 build. (Just for completeness' sake.) ________________________________________ From: Tom Eastep [[email protected]] Sent: Sunday, July 31, 2011 9:03 AM To: Shorewall Users Subject: Re: [Shorewall-users] Newb setup problem: On Sun, 2011-07-31 at 06:48 -0700, Tom Eastep wrote: > On Sun, 2011-07-31 at 06:35 -0700, Tom Eastep wrote: > > On Sun, 2011-07-31 at 06:48 +0000, Andrew Silverman wrote: > > > > > I am setting up a shorewall6-only config to firewall my HE tunnel. The > > > system is a CentOS 6.0 VM (running on Hyper-V but that's not the problem > > > here.) > > > > > > Shorewall6 runs just fine when I "su" and then launch it manually with > > > "shorewall6 start" - no problems, everything behaves exactly as intended, > > > and all the firewall behavior is exactly as I want it to be. So with all > > > that initial config taken care of (much experimentation required) I moved > > > on to trying to get it to start at boot automatically. > > > > > > However, when I try to launch it instead by putting shorewall6 start into > > > /etc/rc.d/rc.local, it fails, and the log only shows me this: > > > > > > [root@ipv6tunl log]# more shorewall6-init.log > > > Jul 30 23:38:10 Processing /etc/shorewall6/params ... > > > Jul 30 23:38:10 ERROR: Processing of /etc/shorewall6/params failed > > > > > > And that's it - nothing else in the log. I tried changing the start line > > > to do tracing to /tmp/trace, but the trace came up empty, so at the > > > moment I am clueless as to why it won't start properly at boot time. > > > > > > FYI, the reason I'm starting it this way rather than by chkconfig is so > > > that I can force a few ip commands to complete first to configure the HE > > > 6in4 tunnel first before starting the firewall that relies on the tunnel > > > being running. > > > > > > Totally open to suggestions, or what more troubleshooting/logging I can > > > provide - NOT a Linux expert, but learning fast. > > > > What are the contents of /etc/shorewall6/params? > > > > Also, which version of Shorewall6 are you running? I've reproduced the problem. It is an SELinux issue whereby a script in /etc/init.d is not permitted to execute /usr/share/shorewall/getparams. You can reproduce the failure by simply typing: /etc/init.d/shorewall6 start Hopefully someone with more SELinux foo than I have (which is none) can give you advice. -Tom -- Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________ ------------------------------------------------------------------------------ Got Input? Slashdot Needs You. Take our quick survey online. Come on, we don't ask for help often. Plus, you'll get a chance to win $100 to spend on ThinkGeek. http://p.sf.net/sfu/slashdot-survey _______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
