ufw requirements not met by goldfish config

Bug #1320329 reported by Jamie Strandboge
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux-goldfish (Ubuntu)
New
Undecided
Unassigned

Bug Description

I ran the security image tests under the x86 emulator and discovered that the kernel configuration is not sufficient to use ufw. Granted, using ufw under the x86 touch emulator is itself a bit of a corner case, however, there shouldn't be a reason to exclude these netfilter options and if the emulator is going to become a touch image smoke test target (eg, http://ci.ubuntu.com/smokeng/utopic/), then this will have to be fixed for the tests to pass.

Steps to reproduce:
1. create and start the emulator (use --revision=NN with 'create' when using already downloaded images in $HOME/emulator ubuntu-emulator). Eg:

$ sudo XDG_CACHE_HOME=$HOME/emulator ubuntu-emulator create --channel=ubuntu-touch/utopic-proposed --arch=i386 test_x86
$ ubuntu-emulator run --scale=0.5 test_x86

2. run the check-requirements script:
$ adb shell /usr/share/ufw/check-requirements -f | grep FAIL
hashlimit: FAIL
limit: FAIL
ctstate (new, recent set): FAIL (no runtime support)
ctstate (new, recent update): FAIL (no runtime support)
ctstate (new, limit): FAIL
multiport: FAIL
comment: FAIL
addrtype (LOCAL): FAIL
addrtype (MULTICAST): FAIL
addrtype (BROADCAST): FAIL
hashlimit: FAIL
limit: FAIL
ctstate (new, recent set): FAIL (no runtime support)
ctstate (new, recent update): FAIL (no runtime support)
ctstate (new, limit): FAIL
multiport: FAIL
comment: FAIL
icmpv6 with hl (neighbor-solicitation): FAIL
icmpv6 with hl (neighbor-advertisement): FAIL
icmpv6 with hl (router-solicitation): FAIL
icmpv6 with hl (router-advertisement): FAIL
ipv6 rt: FAIL

This easiest thing to do would be to use the same netfilter options as on generic or mako.

description: updated
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

This is still affecting goldfish with:
Linux version 3.4.0-4-goldfish (buildd@aatxe) (gcc version 4.7.4 (Ubuntu/Linaro 4.7.4-1ubuntu2) ) #20-Ubuntu PREEMPT Thu Jul 17 17:11:34 UTC 2014

These tests are part of smoke testing, so if goldfish is ever going to be used as part of smoketesting, this will need to be fixed.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.