<div dir="ltr">On Thu, Sep 4, 2008 at 5:11 AM, Didier Roche <span dir="ltr"><<a href="mailto:didrocks@gmail.com">didrocks@gmail.com</a>></span> wrote:<br><div class="gmail_quote"><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div dir="ltr"><br><div class="gmail_quote">2008/9/4 Nicolas Valcárcel <span dir="ltr"><<a href="mailto:nvalcarcel@ubuntu.com" target="_blank">nvalcarcel@ubuntu.com</a>></span><div class="Ih2E3d"><div><br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div>On Wed, 2008-09-03 at 17:33 -0700, Steve Langasek wrote:<br>
> How does this design prevent<br>
> leaving ports open when the package that they legitimately correspond<br>
> to is<br>
> no longer installed?<br>
<br>
</div>I think we can (if it's not already preventing it) add a command<br>
on .postrm that disables it on ufw. At the end this files are just for<br>
declaring profiles, not enabling or open any port, they just describe a<br>
service ports so the user doesn't need to care about them just enable<br>
that service on ufw. So we don't need to care about those files opening<br>
any port, but for disabling them on ufw after removing.<br>
<font color="#888888"><br>
</font></blockquote><div><br></div></div></div></div>The issue is more
complex than that. Because you do not know which profile is currently
loaded (they can be more than one profile by package.<br>A typical example is Apache which has 3 profiles: one for port 80, one for 443 and the last one for both of them.<br>
<br>An idea might be to force (without watching at the error in case
the profile is not associated to a rule) the removal of the
corresponding rules by doing "sudo ufw delete allow <profile>" on
all profiles of the package (and even "sudo ufw delete deny
<profile>"/"sudo ufw delete limit <profile>". Maybe a "sudo
ufw delete any_policy <profile>" will be a good new command).<br>
<br>What is the case if another package use the same port and had it
opened (with ufw profile integration)? Does the port is still open on
the firewall (which is what we really want)?<br></div></blockquote></div><br>I would say leave the ports open and leave the profile files. Leave it up to the user to manage the firewall. If the package is removed, it's not going to be listening on those ports any more anyway.<br>
<br>James<br></div>