RHBA-2015:2422 - Bug Fix Advisory

Topic

Updated firewalld packages that fix several bugs and add various enhancements are now available for Red Hat Enterprise Linux 7.

Description

firewalld is a firewall service daemon that provides a dynamic customizable firewall with a D-Bus interface.

This update fixes the following bugs:

• Prior to this update, it was not possible to add a rich rule concerning ports or protocols if a zone with a non-default target was specified. This bug has been fixed and it is now possible to add such rules to zones with non-default targets. (BZ#1142741)
• Previously, there was a bug which caused the docker package to interfere with the firewalld daemon, which caused many network-related operations to fail. This bug has been fixed, and now firewalld works correctly with docker. (BZ#1161745)
• Before this update, certain options were missing from the man page of the firewall-offline-cmd utility. With this update, the missing documentation is now present. (BZ#1217678)
• Before this update, two ports were missing from the configuration for the "RH-Satellite-6" service. With this update, the ports have been added, meaning all required ports are correctly opened when adding the service. (BZ#1254531)
• Previously, due to a bug in protocol matching, there was an error when certain protocols were specified when creating a service - for example, the Open Shortest Path First (OSPF) protocol. Now, all protocols the system supports can be used both in services and in rich rules. (BZ#1164605)
• Due to a bug in firewalld, permanent direct rules which had been removed were re-applied when reloading. Consequently, simply removing a permanent direct rule and then reloading would not work as expected, without again removing the rule in the runtime environment. This bug has now been fixed and these rules no longer get reapplied after removal. (BZ#1182671)
• Previously, querying and listing direct passthrough rules in the D-Bus interface had authorization requirements which were more strict than other query and list operations. As a consequence, root access was required. This bug has now been fixed and authorization requirements for these operations are now in line with other similar operations and do not require root access. (BZ#1183688)

In addition, this update adds the following enhancements:

• This update adds the targets "iscsi", "rsyncd", "freeipa-ldap", "freeipa-ldaps", and "freeipa-replication" to the list of services supported by the "--add-service" option, so it is now possible to add the default ports for these services by addressing the appropriate target, instead of manually specifying the ports. (BZ#1150656, BZ#1150659 and BZ#1150659)

Users of firewalld are advised to upgrade to these updated packages, which fix these bugs and add these enhancements.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.3 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.3 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux Server from RHUI 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.5 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.4 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.3 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.2 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.3 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.7 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.4 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.3 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 994479 - RFE add configuration file verifier and DTD specificaton
• BZ - 1142741 - can't add rich rule with port/protocol to zone with non-default target
• BZ - 1150656 - [RFE] firewalld service for iscsi
• BZ - 1150659 - [RFE] firewalld service for rsyncd
• BZ - 1161745 - docker interferes with firewall initialisation via firewalld
• BZ - 1164605 - Unable to create service that matches OSPF packets
• BZ - 1176813 - firewalld won't set limit of 1/d
• BZ - 1182671 - Can`t delete direct rule using firewall-cmd
• BZ - 1194382 - [RFE] Backport vdsm.xml service from upstream firewalld
• BZ - 1206490 - [RFE] Backport freeipa-*.xml service from upstream firewalld
• BZ - 1254531 - Add service RH-Satellite-6 missing some ports

CVEs

(none)

References

• http://www.redhat.com/security/updates/classification/#normal