Move iptables symlinks to /usr/bin again
This partially reverts commit cdf3f93581.
This time around, we also manually create symlinks in /usr/sbin to handle
systems with unmerged /usr/sbin. This should fix the problems reported in
https://bodhi.fedoraproject.org/updates/FEDORA-2025-a17e3e5938. For files that
are %ghost, filesystem filetriggers are not triggered, so the symlinks may not
be created automatically (depending on the specific upgrade path).
In the meantime, alternatives has been updated to treat /usr/sbin and /usr/bin
as equivalent, and filesystem has been updated to merge alternatives symlinks
in /usr/sbin. We also need to move the files in this package to allow the merge
to be finalized on upgraded systems.
This commit is contained in:
Zbigniew Jędrzejewski-Szmek
parent
cdf3f93581
commit
f0bc5dc9b6
1 changed files with 46 additions and 14 deletions
|
|
@ -11,7 +11,7 @@ Name: iptables
|
|||
Summary: Tools for managing Linux kernel packet filtering capabilities
|
||||
URL: https://www.netfilter.org/projects/iptables
|
||||
Version: 1.8.11
|
||||
Release: 7%{?dist}
|
||||
Release: 8%{?dist}
|
||||
Source0: %{url}/files/%{name}-%{version}.tar.xz
|
||||
source1: %{url}/files/%{name}-%{version}.tar.xz.sig
|
||||
Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt
|
||||
|
|
@ -61,6 +61,7 @@ Summary: Legacy tools for managing Linux kernel packet filtering capabilities
|
|||
Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release}
|
||||
Requires: %{name}-libs%{?_isa} = %{version}-%{release}
|
||||
Conflicts: setup < 2.10.4-1
|
||||
Conflicts: alternatives < 1.32-1
|
||||
Requires(post): /usr/sbin/update-alternatives
|
||||
Requires(postun): /usr/sbin/update-alternatives
|
||||
%if 0%{?rhel} < 9
|
||||
|
|
@ -249,8 +250,8 @@ mv %{buildroot}/usr/bin/{ip,ip6,arp,eb}tables{,-save,-restore} %{buildroot}/usr/
|
|||
%ldconfig_scriptlets
|
||||
|
||||
%post legacy
|
||||
pfx=/usr/sbin/iptables
|
||||
pfx6=/usr/sbin/ip6tables
|
||||
pfx=%{_sbindir}/iptables
|
||||
pfx6=%{_sbindir}/ip6tables
|
||||
update-alternatives --install \
|
||||
$pfx iptables $pfx-legacy 10 \
|
||||
--slave $pfx6 ip6tables $pfx6-legacy \
|
||||
|
|
@ -259,10 +260,19 @@ update-alternatives --install \
|
|||
--slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \
|
||||
--slave $pfx6-save ip6tables-save $pfx6-legacy-save
|
||||
|
||||
%if "%{_sbindir}" == "%{_bindir}"
|
||||
# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a
|
||||
# directory. Those symlinks will only be created if there is no symlink
|
||||
# or file already.
|
||||
for name in ip{,6}tables{,-save,-restore}; do
|
||||
test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || :
|
||||
done
|
||||
%endif
|
||||
|
||||
%postun legacy
|
||||
if [ $1 -eq 0 ]; then
|
||||
update-alternatives --remove \
|
||||
iptables /usr/sbin/iptables-legacy
|
||||
iptables %{_sbindir}/iptables-legacy
|
||||
fi
|
||||
|
||||
# iptables-1.8.0-1 introduced the use of alternatives
|
||||
|
|
@ -275,8 +285,8 @@ alternatives --list | awk '/^iptables/{print $3; exit}' \
|
|||
cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup
|
||||
|
||||
%triggerpostun legacy -- iptables > 1.8.0
|
||||
pfx=/usr/sbin/iptables
|
||||
pfx6=/usr/sbin/ip6tables
|
||||
pfx=%{_sbindir}/iptables
|
||||
pfx6=%{_sbindir}/ip6tables
|
||||
update-alternatives --install \
|
||||
$pfx iptables $pfx-legacy 10 \
|
||||
--slave $pfx6 ip6tables $pfx6-legacy \
|
||||
|
|
@ -288,6 +298,15 @@ alternatives --set iptables $(</var/tmp/alternatives.iptables.current)
|
|||
rm /var/tmp/alternatives.iptables.current
|
||||
mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables
|
||||
|
||||
%if "%{_sbindir}" == "%{_bindir}"
|
||||
# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a
|
||||
# directory. Those symlinks will only be created if there is no symlink
|
||||
# or file already.
|
||||
for name in ip{,6}tables{,-save,-restore}; do
|
||||
test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || :
|
||||
done
|
||||
%endif
|
||||
|
||||
%post services
|
||||
%systemd_post iptables.service ip6tables.service
|
||||
|
||||
|
|
@ -301,8 +320,8 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables
|
|||
%post -e nft
|
||||
[[ %%{_excludedocs} == 1 ]] || do_man=true
|
||||
|
||||
pfx=/usr/sbin/iptables
|
||||
pfx6=/usr/sbin/ip6tables
|
||||
pfx=%{_sbindir}/iptables
|
||||
pfx6=%{_sbindir}/ip6tables
|
||||
update-alternatives --install \
|
||||
$pfx iptables $pfx-nft 10 \
|
||||
--slave $pfx6 ip6tables $pfx6-nft \
|
||||
|
|
@ -311,7 +330,7 @@ update-alternatives --install \
|
|||
--slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \
|
||||
--slave $pfx6-save ip6tables-save $pfx6-nft-save
|
||||
|
||||
pfx=/usr/sbin/ebtables
|
||||
pfx=%{_sbindir}/ebtables
|
||||
manpfx=%{_mandir}/man8/ebtables
|
||||
for sfx in "" "-restore" "-save"; do
|
||||
if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then
|
||||
|
|
@ -327,7 +346,7 @@ update-alternatives --install \
|
|||
--slave $pfx-restore ebtables-restore $pfx-nft-restore \
|
||||
${do_man:+--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz}
|
||||
|
||||
pfx=/usr/sbin/arptables
|
||||
pfx=%{_sbindir}/arptables
|
||||
manpfx=%{_mandir}/man8/arptables
|
||||
lepfx=%{_libexecdir}/arptables
|
||||
for sfx in "" "-restore" "-save"; do
|
||||
|
|
@ -350,10 +369,19 @@ update-alternatives --install \
|
|||
${do_man:+--slave $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz} \
|
||||
--slave $lepfx-helper arptables-helper $lepfx-nft-helper
|
||||
|
||||
%if "%{_sbindir}" == "%{_bindir}"
|
||||
# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a
|
||||
# directory. Those symlinks will only be created if there is no symlink
|
||||
# or file already.
|
||||
for name in ip{,6}tables{,-save,-restore} ebtables{,-save,-restore} arptables{,-save,-restore}; do
|
||||
test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || :
|
||||
done
|
||||
%endif
|
||||
|
||||
%postun nft
|
||||
if [ $1 -eq 0 ]; then
|
||||
for cmd in iptables ebtables arptables; do
|
||||
update-alternatives --remove $cmd /usr/sbin/$cmd-nft
|
||||
update-alternatives --remove $cmd %{_sbindir}/$cmd-nft
|
||||
done
|
||||
fi
|
||||
|
||||
|
|
@ -365,7 +393,7 @@ fi
|
|||
%{_mandir}/man8/xtables-legacy*
|
||||
%dir %{_datadir}/xtables
|
||||
%{_datadir}/xtables/iptables.xslt
|
||||
%ghost /usr/sbin/ip{,6}tables{,-save,-restore}
|
||||
%ghost %{_sbindir}/ip{,6}tables{,-save,-restore}
|
||||
|
||||
%files libs
|
||||
%license COPYING
|
||||
|
|
@ -426,14 +454,18 @@ fi
|
|||
%{_mandir}/man8/ip{,6}tables{,-restore}-translate*
|
||||
%{_mandir}/man8/ebtables-translate*
|
||||
%{_mandir}/man8/arptables-translate*
|
||||
%ghost /usr/sbin/ip{,6}tables{,-save,-restore}
|
||||
%ghost /usr/sbin/{eb,arp}tables{,-save,-restore}
|
||||
%ghost %{_sbindir}/ip{,6}tables{,-save,-restore}
|
||||
%ghost %{_sbindir}/{eb,arp}tables{,-save,-restore}
|
||||
%ghost %{_libexecdir}/arptables-helper
|
||||
%ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz
|
||||
%ghost %{_mandir}/man8/ebtables.8.gz
|
||||
|
||||
|
||||
%changelog
|
||||
* Wed May 07 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.8.11-8
|
||||
- Reapply the change to keep symlinks managed by alternatives under /usr/bin,
|
||||
this time with a scriptlet create symlinks if /usr/sbin is unmerged.
|
||||
|
||||
* Tue Apr 29 2025 Phil Sutter <psutter@redhat.com> - 1.8.11-7
|
||||
- Revert last release, it breaks alternatives symlinks
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue