Remove ufw from new and existing installs #7315
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Note that I haven't tested the upgrade path yet, I was planning to set it on Friday afternoon and check on it on Monday. |
legoktm
force-pushed
the
stg-remove-ufw
branch
from
8e108a8
to
aa3b4f7
Compare
|
I think I should rework this to be more flexible given #7326. |
We don't use ufw and in noble, it conflicts with iptables-persistent, which we do want to use. Remove it during provisioning and install a systemd timer to remove it. (We can't do it during a postinst because we're already in an apt session at that time.) A testinfra check verifies that the unit does remove the package. This can be extended in the future by adding more ConditionPathExists and more packages to the list. Fixes #7313.
legoktm
force-pushed
the
stg-remove-ufw
branch
from
aa3b4f7
to
cbc957b
Compare
|
I renamed the unit to [Unit]
Description=Remove ufw if installed
ConditionPathExists|=/usr/sbin/ufw
ConditionPathExists|=/usr/sbin/haveged
[Service]
Type=oneshot
Environment="DEBIAN_FRONTEND=noninteractive"
ExecStart=/usr/bin/apt-get purge --yes ufw haveged
User=rootBut, I don't want to do that in this PR because I haven't had the chance to look into haveged yet and let's keep the scope down. |
zenmonkeykstop
approved these changes
Nov 7, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Status
Ready for review
Description of Changes
We don't use ufw and in noble, it conflicts with iptables-persistent, which we do want to use.
Remove it during provisioning and install a systemd timer to remove it. (We can't do it during a postinst because we're already in an apt session at that time.)
Fixes #7313.
Testing
How should the reviewer test this PR?
Deployment
Any special considerations for deployment? Both new installs and upgrades are handled
Checklist