NS8 Mattermost removed app leaves firewall rules

LayLow · June 14, 2024, 8:05am

Hi,

It seems that after removal of the Mattermost module, a firewall rules are left behind:

How can I remove these manually pls?

TIA

HTH

stephdl · June 14, 2024, 11:53am

it should not, except if remove service does not remove UDP port

github.com

NethServer/ns8-mattermost/blob/7c62618984a79c4d2d8bed1f13b602a6b745e891/imageroot/actions/destroy-module/90firewall#L11


      
          #!/usr/bin/env python3
          
          #
          # Copyright (C) 2023 Nethesis S.r.l.
          # SPDX-License-Identifier: GPL-3.0-or-later
          #
          
          import os
          import agent
          
          agent.remove_public_service(os.environ['MODULE_ID'])

stephdl · June 14, 2024, 11:55am

github.com

NethServer/ns8-core/blob/249513929037dbc3b317574df39306ba6c8ebc16/core/imageroot/var/lib/nethserver/node/actions/remove-public-service/50remove#L31


      
          #
          
          import sys
          import json
          import agent
          
          request = json.load(sys.stdin)
          name = request['service']
          
          # Delete the service, it will be automatically removed from all zones
          agent.run_helper('firewall-cmd', '--permanent', f'--delete-service={name}').check_returncode()
          
          # Apply the configuration
          agent.run_helper('firewall-cmd', '--reload').check_returncode()

LayLow · June 14, 2024, 12:23pm

I just installed Mattermost again removed it again. Now I have both instances firewall settings (TCP and UDP) left:

So something is not right I guess?

stephdl · June 14, 2024, 12:36pm

please what is the output

firewall-cmd --list-all-zones

and what is the

firewall-cmd --info-service=mattermost1
firewall-cmd --info-service=mattermost2

adapt to the module_id of mattermost you will find in the public zone

stephdl · June 14, 2024, 12:40pm

evidences
Jun 14 14:37:56 R3.rocky9-3.org agent@mattermost1[3776]: Action destroy-module skipped step 90firewall: fork/exec /home/mattermost1/.config/actions/destroy-module/90firewall: permission denied

stephdl · June 14, 2024, 12:46pm

firewall-cmd --permanent --delete-service=mattermost1
firewall-cmd --reload

LayLow · June 14, 2024, 3:48pm

I can confirm, I changed the permissions to 0755 and uninstalled the module. Firewall rules are correctly adjusted.

stephdl · June 15, 2024, 5:50am

hello laylow, could you please verify this QA

github.com/NethServer/dev

ns8-mattermost: ports in the public zone are not removed with destroy action

opened 12:51PM - 14 Jun 24 UTC

stephdl

bug testing

**Steps to reproduce** - install mattermost in NS8 - configure it destroy t…he module **Expected behavior** I expect the port are not opened anymore in the firewall **Actual behavior** the port are opened in the firewall, you can see it with : firewall-cmd --info-service=mattermost1 evidences: `Jun 14 14:37:56 R3.rocky9-3.org agent@mattermost1[3776]: Action destroy-module skipped step 90firewall: fork/exec /home/mattermost1/.config/actions/destroy-module/90firewall: permission denied ` **Components** ns8-mattermost: 2.0.5 **See also** https://community.nethserver.org/t/ns8-mattermost-removed-app-leaves-firewall-rules/23859 ---- thank laylow

just install and check the bug is not reproducible

thank a lot

LayLow · June 15, 2024, 7:00am

Verified, issue is resolved with Mattermost 2.0.6-dev.1. (I have test repo enabled)

Thanks!

New install via software center of Mattermost 2.0.6-dev.1 and firewall shows:

Remove mattermost via software center and firewall shows:

stephdl · June 15, 2024, 8:21am

thank a lot