Package: ferm
Version: 2.0.6-1
Severity: normal
Tags: patch
Hi,
the LSB header in ferm's init script that ferm should be started in runlevels
2,3 and 5:
# Default-Start: 2 3 5
On the other hand, ferm's postinst script only adds it to runlevel S:
update-rc.d ferm start 41 S . start 36 0 6 .
This is inconsistent, and may generate warnings with dependency based boot
on ferm upgrades.
In addition to thaa,t the late start in the init script is IMHO dangerous,
as it lets a (possibly short) time window open where ferm is not started yet,
while applications may already be up and running.
Hence I consider the postinst variant more secure and this more correct.
In addition, is it really necessary to stop ferm (= flush the firewall rules)
explicetly on shutdown/reboots ?
Please find the attached patch to solve both issues.
(Please note: the patch does not deal with existing rc*d/ links on upgrades)
Thanks for ferm (in Debian & upstream)
Peter
-- System Information:
Debian Release: squeeze/sid
APT prefers testing
APT policy: (990, 'testing'), (500, 'unstable'), (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 2.6.26-2-amd64 (SMP w/2 CPU cores)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages ferm depends on:
ii debconf 1.5.27 Debian configuration management sy
ii iptables 1.4.4-2 administration tools for packet fi
ii lsb-base 3.2-23 Linux Standard Base 3.2 init scrip
ii perl 5.10.0-25 Larry Wall's Practical Extraction
Versions of packages ferm recommends:
ii libnet-dns-perl 0.65-1 Perform DNS queries from a Perl sc
ferm suggests no packages.
-- debconf information:
* ferm/enable: true
--- debian/ferm.init
+++ debian/ferm.init
@@ -9,8 +9,8 @@
# Provides: ferm
# Required-Start: $network
# Required-Stop: $network
-# Default-Start: 2 3 5
-# Default-Stop: 0 6
+# Default-Start: S
+# Default-Stop:
# Description: Starts ferm firewall configuration
# short-description: ferm firewall configuration
### END INIT INFO
--- debian/ferm.rules
+++ debian/ferm.rules
@@ -19,7 +19,7 @@
dh_installdirs -i
dh_installdocs
dh_installchangelogs -i
- dh_installinit -i --no-restart-on-upgrade -- start 41 S . start 36 0 6 .
+ dh_installinit -i --no-restart-on-upgrade -- start 41 S .
dh_installdebconf
dh_install -i
dh_link -i
