[Shorewall-users] shorewall save

[Vieri Di Paola]

Hi,

I've come across an issue regarding shorewall save.

All's well if I run this on the command line as root:

# /bin/sh /usr/sbin/shorewall save
Currently-running Configuration Saved to /var/lib/shorewall/restore

However, running the same command from a script called by init (/etc/inittab) makes it hang "forever".
While running, I can list the process:

# ps aux | grep shore
root 2591 0.0 0.0 13564 6472 ? S 10:24 0:00 /bin/sh /usr/sbin/shorewall save

I noted that the /var/lib/shorewall/restore file is found and complete (with the expected timestamp).
So "shorewall save" seems to at least successfully write the restore file.
However, it doesn't seem to exit.

A simple script to reproduce the issue can be this one:

# cat test.sh
#!/bin/bash
FWD=/tmp
while [ 1 ]; do
sleep 10
if [ -f ${FWD}/test ]; then
echo "$(date) - Saving..." >> ${FWD}/test.log
/usr/sbin/shorewall save
echo "$(date) - Done." >> ${FWD}/test.log
fi
done
exit 0

If I call it in /etc/inittab and touch /tmp/test then I will notice with "ps aux" that the "shorewall save" process never quits, BUT /var/lib/shorewall/restore is successfully created.

Any ideas?

# shorewall version
5.0.15.3

NB: I tested the same setup on another shorewall system and I had no issues there with the script called from inittab. The version there differs.
# shorewall version
5.0.14.1

I also updated the first box to:
# shorewall version
5.0.15.6
but I still have the same issue.

I haven't had time to test 5.1.

Vieri

[Marcelo Roccasalva]

Post by Vieri Di Paola
Hi,
I've come across an issue regarding shorewall save.
# /bin/sh /usr/sbin/shorewall save
Currently-running Configuration Saved to /var/lib/shorewall/restore
However, running the same command from a script called by init (/etc/inittab) makes it hang "forever".

I guess you want to run your script from cron (run periodically), not
from inittab (run and restart immediately if it stops)...

[Vieri Di Paola]

________________________________

Post by Marcelo Roccasalva
I guess you want to run your script from cron (run periodically), not
from inittab (run and restart immediately if it stops)...

No, I want to run it from inittab.
The sample script I sent to the ML is just a simple test script that has nothing to do with the production script I'm using. It was just for others to be able to reproduce this issue.

The interesting thing is that I have the same init version on both failing and working boxes: sysvinit-2.88.

I finally found a solution to my problem.
I don't really know why, but it works.

I changed all calls to the shorewall script so the output is redirected somewhere (in my case /dev/null).

So I changed lines such as:

/usr/sbin/shorewall save
/usr/sbin/shorewall check

to:

/usr/sbin/shorewall save > /dev/null 2>&1 3>&1
/usr/sbin/shorewall check > /dev/null 2>&1 3>&1


Vieri