ufw --force enable runs inside the installer chroot #47
Labels
No labels
P0
P1
P2
P3
audio
bakery
boot
breadbug
bug
build
ci
dependencies
design
disk
docs
encryption
final
firewall
graphics
hardware
idle
installer
keybinds
nvidia
packages
phase-1
polish
recovery
reliability
reproducibility
secure-boot
security
shell
signing
snapshots
supply-chain
swap
tech-debt
theming
ux
website
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
Breadway/bos#47
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Problem
iso/airootfs/etc/calamares/post-install.shlines 441-446. In a chroot that shares the live system's network namespace,ufw enabletries to load rules into the live kernel, which can interfere with the live session's networking mid-install. Only the config needs persisting.Fix
Write
ENABLED=yesto/etc/ufw/ufw.confand set the defaults in/etc/default/ufwdirectly (or useufw --dry-run), and letufw.serviceapply the rules at first boot.Acceptance
The live session's iptables/nft ruleset is unchanged after install, and the installed system boots with ufw active.
Source: BOS v0.6.2 source review (tag dated 2026-09-19); line numbers refer to that tree. Read AGENTS.md first. One issue per branch/PR. Verify with a VM install. Add a CHANGELOG
[Unreleased]entry.ufw --force enableruns inside the installer chroot #65Implemented in PR #65. Installer setup now writes the UFW defaults and ENABLED=yes to the installed system while keeping UFW disabled during the mDNS rule update, so the rule is not reloaded into the live kernel. The issue remains DOING because I could not complete the requested VM install: this runner blocks sudo with no-new-privileges and has only 3.3 GiB free in /tmp, below the space needed for a fresh ISO build. Bash syntax validation, an isolated config harness, and git diff --check pass. No ordinary-push CI is configured for BOS.
Acceptance review
iso/airootfs/etc/calamares/post-install.sh:437-455writes default policies with UFW disabled, saves the mDNS rule, then writesENABLED=yes. This avoids the previousufw --force enablecall. The PR's isolated config harness checks persisted values, but does not verify the live iptables/nft ruleset before and after an install.ENABLED=yesis persisted atiso/airootfs/etc/calamares/post-install.sh:450-451; the existing install loop enablesufw.serviceat line 405. There is no VM boot evidence confirming the service loads the policy and becomes active.CHANGELOG.md:28-30records the installer behavior.I found no CI statuses for head
0644b77e3b6f5ef2170f0b76bfa4b2d3da1f63df; the PR reports no ordinary-push CI. The remaining acceptance is a VM install confirming both that the live firewall ruleset is unchanged and that the installed system boots with UFW active. Please add that evidence on the existing branchfix/bos-47-ufw-installer-chroot; keep PR #65 open for rework.Existing PR #65 now fixes a defect discovered by real headless VM acceptance: disabled ufw allow still probes iptables and creates live filter tables. The block now persists IPv4/IPv6 mDNS rules directly. In a separate Btrfs target chroot sharing the guest network namespace, the complete live nft ruleset remained byte-identical, and repeated runs were idempotent. Booting that prepared target root confirmed ufw.service enabled/active, deny-incoming/allow-outgoing, and both mDNS rules. Evidence is in docs/validation/bos-47-firewall.md, with the limitation that this exercised the exact installer block and target boot rather than interactive Calamares. Ready for independent review. No host firewall or personal configs touched.
Independent review: acceptance still needs the full VM install
Acceptance interpretation: (1) the installer must leave the live guest's complete nft/iptables ruleset unchanged; (2) the installed guest must boot with UFW enabled and active, deny inbound, allow outbound and preserve mDNS; (3) verify this through a VM installation; (4) add an Unreleased changelog entry. The implementation writes UFW config and IPv4/IPv6 rule files without invoking UFW in
iso/airootfs/etc/calamares/post-install.sh:444-475; the changelog is present. The headless target-chroot evidence indocs/validation/bos-47-firewall.md:1-28demonstrates an unchanged ruleset and active UFW after target boot, and it caught the earlier disabled-ufw side effect. Those are meaningful behavioral checks.docs/validation/bos-47-firewall.md:27explicitly says the test was not an interactive Calamares install. The issue requires a VM install. Run the updated ISO through the actual Calamares path in an isolated headless VM, capture the live guest ruleset before and after installation, then boot the installed target and record UFW status and defaults. The current target-chroot evidence can remain as a focused regression check.Please add that evidence on the existing branch
fix/bos-47-ufw-installer-chroot; keep PR #65 open and do not open another PR for BOS-47. Forgejo reports no CI statuses ond6a28be8beeb003ad044532c9974da1198bba4a0, and the PR is mergeable. BOS is release-sensitive, so no merge was attempted.Updated existing PR #65 with current
origin/main(5ae8040); head isb460bf02bdf66b02d4ede2d5841c93fdc31ac5ac.bash -n, static persisted-firewall checks, and PR-diff whitespace checks pass. BOS has no ordinary-push CI configured. The existing target-chroot checks remain useful but do not satisfy the full Calamares VM acceptance. The only available task ISO/guest is the BOS33 run, and its contents have not been verified to include this exact PR head. Root directed no further guest input, no additional ISO build, and no additional VM, so I cannot claim the required full install or keep the firewall issue in DOING for an active test. Leaving BOS-47 in TODO pending a matching-ISO Calamares install that records live rules before/after and confirms UFW active after installed-system boot.PR #65 has the implementation and target-chroot firewall checks recorded on the rebased head. A matching-ISO Calamares install with before/after live firewall state and installed UFW checks remains outstanding; BOS has no ordinary push CI. Moving the implementation to REVIEW for the requested handoff. Do not treat as verified or done until those acceptance checks are recorded.