mirror of
https://github.com/jhd3197/ServerKit.git
synced 2026-04-26 08:25:59 +03:00
[GH-ISSUE #12] Firewall detection broken on Fedora/RHEL #3
Labels
No labels
bug
pull-request
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/ServerKit#3
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @keyxmakerx on GitHub (Feb 1, 2026).
Original GitHub issue: https://github.com/jhd3197/ServerKit/issues/12
Bug Description
Firewall detection silently fails on any non-Debian system. Two root causes: (1) dpkg calls in _check_firewalld() and _check_ufw() are not wrapped in a try/except, so FileNotFoundError on Fedora/RHEL kills the entire method before the binary path fallback check runs. (2) Several firewall-cmd query commands are missing sudo, causing "Authorization failed" when the backend runs as a non-root user. The rule-manipulation commands already use sudo — only the query commands were missed (--state, --get-default-zone, --list-services, --list-ports, --list-rich-rules, --get-zones, --zone= --list-all).
Steps to Reproduce
Deploy ServerKit on Fedora 43 (or any RHEL-based system)
Run the backend as a non-root user (standard systemd deployment)
Open the Firewall panel in the UI
Expected Behavior
Firewall panel detects firewalld, displays current zones and rules, and allows rule management.
Actual Behavior
Panel shows "No firewall detected". API returns {"success": false, "error": "No firewall detected"} on /api/v1/firewall/rules.
Environment
LogTide Version:
Deployment Type: Self-hosted
OS: Fedora 43
Browser (if applicable): Firefox 121
Docker Version (if self-hosted):
Logs/Screenshots
Failed to load rules: Error: No firewall detected
handleResponse https://dnsdashboard.bnuuy.haus/assets/index-DZuh55VW.js:1
Running firewall-cmd as non-root without sudo:
$ firewall-cmd --state
Authorization failed.
Make sure polkit agent is running or run the application as superuser.
Confirmed firewalld is running:
$ sudo firewall-cmd --state
running
Additional Context
The dpkg binary does not exist on Fedora/RHEL. When subprocess.run(['dpkg', ...]) is called without a try/except, it throws FileNotFoundError, which is caught by the outer except Exception block in each method — returning installed: False before the binary path check (os.path.exists('/usr/sbin/firewall-cmd')) ever runs. This affects both _check_firewalld() and _check_ufw(). The missing sudo on query commands is a secondary issue that surfaces once detection is fixed — firewall-cmd requires root on Fedora for all operations, not just rule changes.
Contribution
@jhd3197 commented on GitHub (Feb 10, 2026):
I'm going to investigate this issue!
@jhd3197 commented on GitHub (Feb 10, 2026):
@keyxmakerx
Both root causes have been addressed:
1. Exception handling for
dpkgon non-Debian systemsThe firewall service now uses a centralized
PackageManager.is_installed()utility that detects the system's package manager (apt/dnf/yum) and queries accordingly —dpkg -son Debian-based systems,rpm -qon RHEL/Fedora. All calls are wrapped intry/except FileNotFoundErrorso a missing binary never crashes the detection flow. Both_check_firewalld()and_check_ufw()also have top-level exception guards that return a safe default instead of propagating errors.2. Missing
sudoonfirewall-cmdqueriesAll subprocess calls in the firewall service now go through a
run_privileged()helper that automatically prependssudowhen the process isn't running as root. This covers every command you listed:--state,--get-default-zone,--list-services,--list-ports,--list-rich-rules,--get-zones, and--zone=...--list-all.CI coverage
We added a multi-distro CI workflow (#16) that runs integration tests on Ubuntu 24.04, Debian, Fedora 41, and Rocky Linux to catch cross-platform issues like this going forward.
These changes are on
prod. Would you be able to verify on your Fedora 43?