Breadway/bos
1
0
Fork 0
Code Issues 5 Pull requests 1 Projects Releases 9 Packages Wiki Activity Actions

ufw --force enable runs inside the installer chroot #65

Merged
Breadway merged 5 commits from fix/bos-47-ufw-installer-chroot into main 2026-10-02 14:29:09 +08:00
Conversation 2 Commits 5 Files changed 3 +67 -6
Breadway commented 2026-09-30 04:10:10 +08:00
Owner
Copy link

The installer persists UFW defaults, IPv4/IPv6 mDNS rules, and ENABLED=yes directly in the target filesystem. It makes no UFW CLI call that could probe or change the live kernel. ufw.service applies the saved policy on first boot.

A real headless KVM target-chroot test found that the previous disabled ufw allow call created live filter tables. After this correction, the complete live nft ruleset stayed byte-identical, and two installer runs preserved identical UFW rule files. Rebooting into that target root produced enabled and active ufw.service, deny-inbound/allow-outbound defaults, and both mDNS rules. Exact evidence and limits are in docs/validation/bos-47-firewall.md. This validates the exact installer block and target boot, without claiming an interactive Calamares run. Bash syntax and git diff --check pass.

Closes #47

The installer persists UFW defaults, IPv4/IPv6 mDNS rules, and ENABLED=yes directly in the target filesystem. It makes no UFW CLI call that could probe or change the live kernel. ufw.service applies the saved policy on first boot. A real headless KVM target-chroot test found that the previous disabled ufw allow call created live filter tables. After this correction, the complete live nft ruleset stayed byte-identical, and two installer runs preserved identical UFW rule files. Rebooting into that target root produced enabled and active ufw.service, deny-inbound/allow-outbound defaults, and both mDNS rules. Exact evidence and limits are in docs/validation/bos-47-firewall.md. This validates the exact installer block and target boot, without claiming an interactive Calamares run. Bash syntax and git diff --check pass. Closes #47
Merge main into installer firewall rework
All checks were successful
Build and publish calamares / calamares (push) Successful in 4m19s
Details
Build and publish calamares / calamares (pull_request) Successful in 4m20s
Details
Build and publish powerlevel10k / powerlevel10k (push) Successful in 1m28s
Details
59f75fabbd
Breadway commented 2026-10-01 15:27:02 +08:00
Author
Owner
Copy link

Re-review: required Calamares VM install is still outstanding

Acceptance interpretation: (1) a complete installer run must leave the live guest firewall rules unchanged; (2) the installed guest must boot with UFW active, deny inbound and allow outbound, with mDNS allowed; (3) verify this through a VM installation; (4) retain the Unreleased changelog entry.

The target-chroot test in docs/validation/bos-47-firewall.md:1-28 checks the exact persistence block and target boot behavior, and the changelog and implementation are present. The evidence explicitly stops short of a Calamares ISO installation. This is a required issue criterion, so the existing PR is incomplete even though the target-chroot evidence is useful. Forgejo reports no CI statuses for head d6a28be8beeb003ad044532c9974da1198bba4a0; BOS has no ordinary push CI configured.

  • Run the updated ISO through Calamares in an isolated headless VM. Capture the guest live nftables/iptables state before and after installation, boot the installed target, and record UFW active state and policy.

Rework on the existing branch fix/bos-47-ufw-installer-chroot. Keep PR #65 open and do not open a second PR for BOS-47. No host firewall or desktop config change is needed.

## Re-review: required Calamares VM install is still outstanding Acceptance interpretation: (1) a complete installer run must leave the live guest firewall rules unchanged; (2) the installed guest must boot with UFW active, deny inbound and allow outbound, with mDNS allowed; (3) verify this through a VM installation; (4) retain the Unreleased changelog entry. The target-chroot test in `docs/validation/bos-47-firewall.md:1-28` checks the exact persistence block and target boot behavior, and the changelog and implementation are present. The evidence explicitly stops short of a Calamares ISO installation. This is a required issue criterion, so the existing PR is incomplete even though the target-chroot evidence is useful. Forgejo reports no CI statuses for head `d6a28be8beeb003ad044532c9974da1198bba4a0`; BOS has no ordinary push CI configured. - [ ] Run the updated ISO through Calamares in an isolated headless VM. Capture the guest live nftables/iptables state before and after installation, boot the installed target, and record UFW active state and policy. Rework on the existing branch `fix/bos-47-ufw-installer-chroot`. Keep PR #65 open and do not open a second PR for BOS-47. No host firewall or desktop config change is needed.
Breadway commented 2026-10-01 16:27:16 +08:00
Author
Owner
Copy link

PR #65 has the implementation and target-chroot firewall checks recorded on the rebased head. A matching-ISO Calamares install with before/after live firewall state and installed UFW checks remains outstanding; BOS has no ordinary push CI. Moving the implementation to REVIEW for the requested handoff. Do not treat as verified or done until those acceptance checks are recorded.

PR #65 has the implementation and target-chroot firewall checks recorded on the rebased head. A matching-ISO Calamares install with before/after live firewall state and installed UFW checks remains outstanding; BOS has no ordinary push CI. Moving the implementation to REVIEW for the requested handoff. Do not treat as verified or done until those acceptance checks are recorded.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
P0

   
P1

   
P2

   
P3

   
audio

   
bakery

   
boot

   
breadbug

   
bug

   
build

   
ci

   
dependencies

   
design

   
disk

   
docs

   
encryption

   
final

   
firewall

   
graphics

   
hardware

   
idle

   
installer

   
keybinds

   
nvidia

   
packages

   
phase-1

   
polish

   
recovery

   
reliability

   
reproducibility

   
secure-boot

   
security

   
shell

   
signing

   
snapshots

   
supply-chain

   
swap

   
tech-debt

   
theming

   
ux

   
website
No labels
P0
P1
P2
P3
audio
bakery
boot
breadbug
bug
build
ci
dependencies
design
disk
docs
encryption
final
firewall
graphics
hardware
idle
installer
keybinds
nvidia
packages
phase-1
polish
recovery
reliability
reproducibility
secure-boot
security
shell
signing
snapshots
supply-chain
swap
tech-debt
theming
ux
website
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Breadway/bos!65
No description provided.