ufw starts after some network daemons due to move to upstart in Ubuntu

Bug #431804 reported by Jamie Strandboge on 2009-09-17
258
This bug affects 1 person
Affects Status Importance Assigned to Milestone
ufw (Ubuntu)
Low
Jamie Strandboge

Bug Description

Binary package hint: ufw

Due to the fixes for bug #427356, several network aware daemons are now started before ufw. This provides a small window where network daemons are running without a firewall. This constitutes a security risk (although small) for people who enable the firewall and expect its protection (eg in hostile wireless networks). This can be fixed with an upstart job.

Jamie Strandboge (jdstrand) wrote :

The fix has been committed to bzr.

visibility: private → public
Changed in ufw (Ubuntu):
assignee: nobody → Jamie Strandboge (jdstrand)
importance: Undecided → Low
status: New → Fix Committed
Jamie Strandboge (jdstrand) wrote :

Here is the upstart job:

# ufw - Uncomplicated Firewall
#
# The Uncomplicated Firewall is a front-end for iptables, to make managing a
# Netfilter firewall easier.

description "Uncomplicated firewall"

start on net-device-added INTERFACE=lo
stop on runlevel [!023456]

pre-start script
    grep -q -i '^ENABLED=yes' /etc/ufw/ufw.conf || exit 1
    exec /lib/ufw/ufw-init start
end script

post-stop exec /lib/ufw/ufw-init stop

The "|| exit 1" is superfluous, the grep failing on its own is enough to fail the job

Otherwise looks good as a rule

Jamie Strandboge (jdstrand) wrote :

I ended up getting rid of all of it. After more thought I decided that I didn't like init complaining that ufw exited with error. I though it would cause confusion, especially for server users. So the job file is simpler, if ufw is enabled there is no console output (except if an error). If it disabled, it exits 0 and lets you know nothing was done. This is achieved with the following upstart job file:

# ufw - Uncomplicated Firewall
#
# The Uncomplicated Firewall is a front-end for iptables, to make managing a
# Netfilter firewall easier.

description "Uncomplicated firewall"

start on net-device-added INTERFACE=lo
stop on runlevel [!023456]

console output

pre-start exec /lib/ufw/ufw-init start
post-stop exec /lib/ufw/ufw-init stop

Jamie Strandboge (jdstrand) wrote :

Per slangasek, this does not require a separate FFe, as it is really part of bug #427356. From IRC:

11:53 < jdstrand> slangasek: does bug #431804 require an FFe? it is fixing a
                  bug by introducing a feature (upstart script)
12:06 < slangasek> jdstrand: I think that's covered by the existing FFe for
                   boot work; you might want to just drop a comment in that bug
                   (and/or open a task)

Launchpad Janitor (janitor) wrote :

This bug was fixed in the package ufw - 0.29-3

---------------
ufw (0.29-3) unstable; urgency=low

  * use upstart instead of sysv initscript on Ubuntu (LP: #431804)
    - debian/control: Bump build-dependency on debhelper for Upstart-aware
      dh_installinit. Add Build-Dep on lsb-release
    - add debian/ufw.upstart.ubuntu
    - move debian/ufw.init to debian/ufw.init.debian
    - debian/ufw.init: rename to debian/ufw.init.debian and update insserv
      info to reflect reality
    - debian/rules: use upstart if Ubuntu and sysv if Debian
    - debian/postinst and debian/postrm: remove calls to update-rc.d
  * error out when filesystem is read-only. Merge from trunk (LP: #430053)
  * catch exception if can't find parent pid when refreshing application
    profiles. Merge from trunk (LP: #424528)
  * add doc/upstart.example and update README for Debian users who want to
    use upstart

 -- Jamie Strandboge <email address hidden> Fri, 18 Sep 2009 15:35:45 +0100

Changed in ufw (Ubuntu):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public Security information  Edit
Everyone can see this security related information.

Other bug subscribers