OpenMandriva Lx version:
OpenMandriva Lx release 26.02 (ROME) Rolling for x86_64
Desktop environment (KDE, LXQT…):
KDE
Description of the issue (screenshots if relevant):
The firewalld service will not enable. Many distros use this with zones for Home, Work, Public, etc. I did sudo dnf install firewalld plasma-firewall firewall-config firewall-applet. Install is successful. Then I run sudo systemctl enable --now firewalld which gives this error:
Job for firewalld.service failed because the control process exited with error code.
See "systemctl status firewalld.service" and "journalctl -xeu firewalld.service" for details.
Relevant informations (hardware involved, software version, logs or output…): systemctl status firewalld.service:
░░ A start job for unit firewalld.service has begun execution.
░░
░░ The job identifier is 23107.
Jul 23 23:44:18 BOM-PC systemd[1]: firewalld.service: Main process exited, code=exited, status=1/FAILURE
░░ Subject: Unit process exited
░░ Defined-By: systemd
░░ Support: https://openmandriva.org
░░
░░ An ExecStart= process belonging to unit firewalld.service has exited.
░░
░░ The process' exit code is 'exited' and its exit status is 1.
Jul 23 23:44:18 BOM-PC systemd[1]: firewalld.service: Failed with result 'exit-code'.
░░ Subject: Unit failed
░░ Defined-By: systemd
░░ Support: https://openmandriva.org
░░
░░ The unit firewalld.service has entered the 'failed' state with result 'exit-code'.
Jul 23 23:44:18 BOM-PC systemd[1]: Failed to start firewalld.service - firewalld - dynamic firewall daemon.
░░ Subject: A start job for unit firewalld.service has failed
░░ Defined-By: systemd
░░ Support: https://openmandriva.org
░░
░░ A start job for unit firewalld.service has finished with a failure.
░░
░░ The job identifier is 23107 and the job result is failed.
...skipping...
░░ A start job for unit firewalld.service has begun execution.
░░
░░ The job identifier is 23107.
Jul 23 23:44:18 BOM-PC systemd[1]: firewalld.service: Main process exited, code=exited, status=1/FAILURE
░░ Subject: Unit process exited
░░ Defined-By: systemd
░░ Support: https://openmandriva.org
░░
░░ An ExecStart= process belonging to unit firewalld.service has exited.
░░
░░ The process' exit code is 'exited' and its exit status is 1.
Jul 23 23:44:18 BOM-PC systemd[1]: firewalld.service: Failed with result 'exit-code'.
░░ Subject: Unit failed
░░ Defined-By: systemd
░░ Support: https://openmandriva.org
░░
░░ The unit firewalld.service has entered the 'failed' state with result 'exit-code'.
Jul 23 23:44:18 BOM-PC systemd[1]: Failed to start firewalld.service - firewalld - dynamic firewall daemon.
░░ Subject: A start job for unit firewalld.service has failed
░░ Defined-By: systemd
░░ Support: https://openmandriva.org
░░
░░ A start job for unit firewalld.service has finished with a failure.
░░
░░ The job identifier is 23107 and the job result is failed.
Jul 24 05:14:17 heisenberg-linux systemd[1]: Starting firewalld.service - firewalld - dynamic firewall daemon...
░░ Subject: A start job for unit firewalld.service has begun execution
░░ Defined-By: systemd
░░ Support: https://openmandriva.org
░░
░░ A start job for unit firewalld.service has begun execution.
░░
░░ The job identifier is 7466.
Jul 24 05:14:17 heisenberg-linux systemd[1]: firewalld.service: Main process exited, code=exited, status=1/FAILURE
░░ Subject: Unit process exited
░░ Defined-By: systemd
░░ Support: https://openmandriva.org
░░
░░ An ExecStart= process belonging to unit firewalld.service has exited.
░░
░░ The process' exit code is 'exited' and its exit status is 1.
Jul 24 05:14:17 heisenberg-linux systemd[1]: firewalld.service: Failed with result 'exit-code'.
░░ Subject: Unit failed
░░ Defined-By: systemd
░░ Support: https://openmandriva.org
░░
░░ The unit firewalld.service has entered the 'failed' state with result 'exit-code'.
Jul 24 05:14:17 heisenberg-linux systemd[1]: Failed to start firewalld.service - firewalld - dynamic firewall daemon.
░░ Subject: A start job for unit firewalld.service has failed
░░ Defined-By: systemd
░░ Support: https://openmandriva.org
░░
░░ A start job for unit firewalld.service has finished with a failure.
░░
░░ The job identifier is 7466 and the job result is failed.
Hi @NLA Welcome. I’m in the process of setting up another ROME machine right now myself and ran into this issue, so I looked at the config. The config is located at (well linked to) /etc/systemd/system/multi-user.target.wants/firewalld.service for reference. What I found was that there are a lot of systemd hardening options enabled which on a macro level are the reason why the service fails to start. I’m quite sure that DevicePolicy=closed by itself would cause the failure, and I don’t ever use these in my firewalld configs, so I commented them out and made a couple of other changes in order for the file to look more like what I normally use. Please see the contents of my file below. I’m not advising you on what to do, but rather sharing what I did, and what I’m cool with. Alternatively, you could look into experimenting with all of these configs to find something that works, which is not a path I went down. At any rate, edit the file how you desire, save and run ‘systemctl daemon-reload’ to pick up the changes, and ‘systemctl start firewalld’ to start in order to test. Good luck.
We used to put three ticks before and after a block, but now the trailing ticks are no longer needed. I found that confusing as well, but I don’t know when it started, as I was not here at the time.
iptables and nftables stuff both come in with firewalld as it stands a level above them as a management layer, so both are still needed in this case and configuration.
That removed everything to do with iptables. After that, I was able to install the firewall using the Welcome app.
Welcome > Configure > Security > Install and Configure your Firewall.
It all works fine after that. I enabled it using the Plasma System Settings app.
System Settings > Wi-Fi & Internet > Firewall
Even if you remove some part that it needs, it will reinstall what it needs. However, I no longer have the conflict that was preventing firewalld from starting.
I believe that when you removed those packages, firewalld was also removed. Then when you went to OM Welcome and installed the firewall, it installs plasma-firewall which has firewalld as a dependency and then you were back where you started but with more packages.
Thanks for bringing this up… LOL. If we look at the spec file here:
then we can see that it would break existing firewalld installs on upgrade if they had default configurations that worked previously. Why I LOLed is because it would also break what I did earlier in this thread on upgrade, which I don’t much care about for me because I’m fine once in a blue moon looking at the file. It’s probably not great to say to other people. This is where we get into the systemd topic people love… The correct way to do the edits for them to be preserved across upgrades is systemctl edit. Again, for my situation, I don’t get into all of that. I just make sure it’s running, set drop to the active zone, and test with nmap for the type of response I’m looking for. Also, it should be stated that there’s nothing wrong with the firewalld packaging, everything is done in the standard, right way.
If you want something done about this you need to take the issue directly to OpenMandriva Cooker Chat channel. Apparently not enough people have complained yet. Or something I do not understand.
It seems counterproductive to make the assumption that because some OM devs believe, probably correctly, that firewalls are useless that users, most especially new users coming from Windows, will accept this explanation. They do not, they will not, and we darn well know this.
I’ll keep bringing up the circumstance of using public wifi say for example the countryside of Ecuador or rural Mississippi.
I’ll point out here that removing a firewall (specifically iptables and nftables - though I don’t remember which one is the trigger) will also break virt-manager.
Here’s my firewalld.service file (I’m running ROCK) and it seems to work. I did have to fiddle with it a bit when I first set things up at the time and I wish I had kept better notes
There are differences in the file (Conflicts line and a whole bunch of stuff commented out - which I think you said you did?):
If we go with the numbers as they are above: I deleted line 5, amended line 8, and commented out lines 20-35. Again, as stated above, this is what I did and what I’m cool with, not specifically suggesting it’s what anyone else does in a precise manner-just participating in the discussion. This is just how I roll, and it works for me and in general says nmap from my other hosts.
I’ll have to experiment. What I posted was the default config on ROCK. Hopefully I’ll be able to start playing around with ROME and COOKER again this weekend.
