import firewalld-1.0.0-4.el9

SOURCES/0002-fix-firewalld-keep-linux-capability-CAP_SYS_MODULE.patch

@@ -1,7 +1,7 @@
-From 07db6dfac060d474b73f9b963435f4b6472e3f48 Mon Sep 17 00:00:00 2001
+From 09cdc166ddfe53b6e8ce3a2920f798320c170b7f Mon Sep 17 00:00:00 2001
 From: Eric Garver <eric@garver.life>
 Date: Wed, 11 Aug 2021 14:47:59 -0400
-Subject: [PATCH] fix(firewalld): keep linux capability CAP_SYS_MODULE
+Subject: [PATCH 2/3] fix(firewalld): keep linux capability CAP_SYS_MODULE
 
 When firewalld calls ip6tables it may implicitly load the ip6_tables, et
 al kernel modules. As such we need to retain CAP_SYS_MODULE so that

SOURCES/0003-fix-firewalld-check-capng_apply-return-code.patch

@@ -0,0 +1,48 @@
+From 4a627847d36afedfca20026fb763fbb71005b92f Mon Sep 17 00:00:00 2001
+From: Eric Garver <eric@garver.life>
+Date: Mon, 30 Aug 2021 13:24:47 -0400
+Subject: [PATCH 3/3] fix(firewalld): check capng_apply() return code
+
+If dropping capabilities is blocked by SELinux, e.g. old selinux-policy,
+then capng_apply() will return non-zero. Also check other things that
+may fail, i.e. capng_update().
+
+Fixes: rhbz 1999090
+(cherry picked from commit 36749f512bbcfc55f0e9e46354009073941d7363)
+(cherry picked from commit cf7f3320c78a8b3f2b8f22779c5747f113d25c57)
+---
+ src/firewalld.in | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/src/firewalld.in b/src/firewalld.in
+index b1c886c6f02f..38331a0b49a9 100755
+--- a/src/firewalld.in
++++ b/src/firewalld.in
+@@ -140,14 +140,16 @@ def startup(args):
+         try:
+             import capng
+             capng.capng_clear(capng.CAPNG_SELECT_BOTH)
+-            capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET,
+-                               capng.CAP_NET_ADMIN)
+-            capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET,
+-                               capng.CAP_NET_RAW)
+-            capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET,
+-                               capng.CAP_SYS_MODULE)
+-            capng.capng_apply(capng.CAPNG_SELECT_BOTH)
+-            log.info(log.INFO1, "Dropped Linux capabilities to NET_ADMIN, NET_RAW, SYS_MODULE.")
++            if capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET,
++                                  capng.CAP_NET_ADMIN) or \
++               capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET,
++                                  capng.CAP_NET_RAW) or \
++               capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET,
++                                  capng.CAP_SYS_MODULE) or \
++               capng.capng_apply(capng.CAPNG_SELECT_BOTH):
++                log.info(log.INFO1, "libcap-ng failed to drop Linux capabilities.")
++            else:
++                log.info(log.INFO1, "Dropped Linux capabilities to NET_ADMIN, NET_RAW, SYS_MODULE.")
+         except ImportError:
+             pass
+ 
+-- 
+2.31.1
+

SPECS/firewalld.spec

@@ -1,12 +1,13 @@
 Summary: A firewall daemon with D-Bus interface providing a dynamic firewall
 Name: firewalld
 Version: 1.0.0
-Release: 3%{?dist}
+Release: 4%{?dist}
 URL:     http://www.firewalld.org
 License: GPLv2+
 Source0: https://github.com/firewalld/firewalld/releases/download/v%{version}/firewalld-%{version}.tar.gz
 Patch1: 0001-RHEL-only-Add-cockpit-by-default-to-some-zones.patch
 Patch2: 0002-fix-firewalld-keep-linux-capability-CAP_SYS_MODULE.patch
+Patch3: 0003-fix-firewalld-check-capng_apply-return-code.patch
 BuildArch: noarch
 BuildRequires: autoconf
 BuildRequires: automake
@@ -228,7 +229,10 @@ rm -rf %{buildroot}%{_datadir}/firewalld/testsuite
 %{_mandir}/man1/firewall-config*.1*
 
 %changelog
-* Tue Sep 07 2021 Eric Garver <egarver@redhat.com> - 1.0.0-3
+* Mon Nov 22 2021 Eric Garver <egarver@redhat.com> - 1.0.0-4
+- fix(firewalld): check capng_apply() return code
+
+* Mon Nov 22 2021 Eric Garver <egarver@redhat.com> - 1.0.0-3
 - fix(firewalld): keep linux capability CAP_SYS_MODULE
 
 * Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 1.0.0-2