Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 531390

Summary: net-firewall/iptables: circular dependencies in systemd restore service units
Product: Gentoo Linux Reporter: mike <mike>
Component: Current packagesAssignee: Gentoo's Team for Core System packages <base-system>
Status: CONFIRMED ---    
Severity: normal CC: alexander, jstein, systemd
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
Package list:
Runtime testing required: ---

Description 2014-12-02 01:16:45 UTC
The systemd iptables-restore.service and ip6tables-restore.service units have '' as well as ''. Between the ordering implied by and being the default dependency of all service units this creates a dependency loop. The iptables rules shouldn't be loaded before anyway since it needs things like a working filesystem. The usual is more appropriate. Also recent versions of systemd introduced a specifically for firewalls. So the two units should probably look something more like this:

> [Unit]
> Description=Restore iptables firewall rules
> Conflicts=iptables-store.service
> [Service]
> Type=oneshot
> ExecStart=/sbin/iptables-restore /var/lib/iptables/rules-save
> [Install]
Comment 1 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2014-12-02 10:16:11 UTC
Looks fine to me. Could some other team member ACK and commit it? It's my unit, so no need for another ACK from maintainer.
Comment 2 Matthias Maier gentoo-dev 2014-12-02 20:56:15 UTC
Looks fine for me, too.

the shouldn't be strictly necessary (however, is).