On Sun, 14 Sep 2025 21:06:14 -0000 "Joe Average" <sixpac...@online.de> wrote:
> Franta Hanzlík wrote: > .... > > But - is there any better "more systematic" solution? > > AFAIK the module is only build once: when the new kernel first boots > so my idea would be: just a new reboot > cause the module for the last installed kernel should be now there and should > load > > No ? > -- IMO waiting after first boot two minutes or so (for akmods to finish) and rebooting again is also a pretty bad solution - maybe even worse than my automated waiting for akmods to finish in the script and then restarting iptables in one reboot. Moreover, in both cases, the bad thing is that the system is in a state where the network is active and without a firewall for some time. This is especially dangerous in the systemd era, when the end of such "one shot" services is chaotic and unmanaged - so it is probably not possible to start the network until after akmods has finished. Also, due to the shortcomings of systemd network start, it is now recommended to configure network services to listen on 0.0.0.0 (and not only on specific IP addresses) - so insecure LAN-only services running on firewall router are accessible from the Internet if the firewall is not started. Or am I wrong? I admit that I still don't know the monstrous systemd in detail... A slightly better solution is probably to initially run the firewall without the akmods-built modules and then update the firewall with the geoip filter after the akmods has run. But isn't there an even better solution? -- Franta Hanzlik -- _______________________________________________ users mailing list -- users@lists.fedoraproject.org To unsubscribe send an email to users-le...@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/users@lists.fedoraproject.org Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
