Shorewall users - Oct 2003 - Debian shorewall.conf (1.4.7c) setting for lock file /var/lock FYI

Hello,

Concerning Debian(testing) Shorewall(1.4.7c) installs,  "/var/state"
dir is
_not_ guaranteed to exist, while a /var/lock _is_, and a /var/lock/subsys is
_never_.
>From /etc/shorewall/shorewall.conf: (1.4.7c)
<snip>
# SUBSYSTEM LOCK FILE
#
# Set this to the name of the lock file expected by your init scripts. For
# RedHat, this should be /var/lock/subsys/shorewall. On Debian, it
# should be /var/state/shorewall. If your init scripts don''t use lock
files,
# set this to "".
#
SUBSYSLOCK=/var/lock/subsys/shorewall
<snip>

I set "SUBSYSLOCK=/var/lock/shorewall"

This is not a big issue really, just noticed it (no /var/state) on a fresh
"testing" install. Other Debian boxes indicate that certain apache
mods
create the "/var/state" dir. Of course the lock file could be
anywhere, I
don''t know what definitions there are for these directory''s
proper usages.

Just my two late night cents.

Alex Martin
http://www.rettc.com

Hi Alex,

On Mon, 2003-10-27 at 00:44, Alex Martin wrote:
> Hello,
> 
> Concerning Debian(testing) Shorewall(1.4.7c) installs, 
"/var/state" dir is
> _not_ guaranteed to exist, while a /var/lock _is_, and a /var/lock/subsys
is
> _never_.
> 
> >From /etc/shorewall/shorewall.conf: (1.4.7c)
> 
> <snip>
> # SUBSYSTEM LOCK FILE
> #
> # Set this to the name of the lock file expected by your init scripts. For
> # RedHat, this should be /var/lock/subsys/shorewall. On Debian, it
> # should be /var/state/shorewall. If your init scripts don''t use
lock files,
> # set this to "".
> #
> SUBSYSLOCK=/var/lock/subsys/shorewall
> <snip>
> 
> I set "SUBSYSLOCK=/var/lock/shorewall"
> 
> This is not a big issue really, just noticed it (no /var/state) on a fresh
> "testing" install. Other Debian boxes indicate that certain
apache mods
> create the "/var/state" dir. Of course the lock file could be
anywhere, I
> don''t know what definitions there are for these
directory''s proper usages.
> 
> Just my two late night cents.
Did you use the .deb or ???

I''m asking to be certain if you are reporting about a stale comment in
shorewall.conf (since I''m pretty sure that at one time, Debian did use
that directory for init''s lock files) or if you are reporting
non-standard behavior of the .deb.

SUBSYSLOCK should point to wherever ''init'' looks for lock
files; if your
''init'' doesn''t use them then there is no point in
setting the variable.

-Tom
-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net

On Mon, 2003-10-27 at 12:33, Tom Eastep wrote:
> > This is not a big issue really, just noticed it (no /var/state) on a
fresh
> > "testing" install. Other Debian boxes indicate that certain
apache mods
> > create the "/var/state" dir. Of course the lock file could
be anywhere, I
> > don''t know what definitions there are for these
directory''s proper usages.
> > 
> > Just my two late night cents.
> 
> Did you use the .deb or ???
> 
> I''m asking to be certain if you are reporting about a stale
comment in
> shorewall.conf (since I''m pretty sure that at one time, Debian did
use
> that directory for init''s lock files) or if you are reporting
> non-standard behavior of the .deb.
> 
> SUBSYSLOCK should point to wherever ''init'' looks for lock
files; if your
> ''init'' doesn''t use them then there is no point
in setting the variable.
> 
FWIW, I just booted up my Debian config (vmware). While it is admittedly
a bit old (a year or so), it''s init doesn''t appear to use lock
files in
the manner that RH init does.

I''ve copied the Debian Shorewall maintainer who will probably be able
to
give us the definitive word.

-Tom
-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net

* Tom Eastep <teastep@shorewall.net>: 
> On Mon, 2003-10-27 at 12:33, Tom Eastep wrote:
> 
> > > This is not a big issue really, just noticed it (no /var/state)
on a fresh
> > > "testing" install. Other Debian boxes indicate that
certain apache mods
> > > create the "/var/state" dir. Of course the lock file
could be anywhere, I
> > > don''t know what definitions there are for these
directory''s proper usages.
> > > 
> > > Just my two late night cents.
> > 
> > Did you use the .deb or ???
> > 
> > I''m asking to be certain if you are reporting about a stale
comment in
> > shorewall.conf (since I''m pretty sure that at one time,
Debian did use
> > that directory for init''s lock files) or if you are reporting
> > non-standard behavior of the .deb.
> > 
> > SUBSYSLOCK should point to wherever ''init'' looks for
lock files; if your
> > ''init'' doesn''t use them then there is no
point in setting the variable.
> > 
> 
> FWIW, I just booted up my Debian config (vmware). While it is admittedly
> a bit old (a year or so), it''s init doesn''t appear to use
lock files in
> the manner that RH init does.
> 
> I''ve copied the Debian Shorewall maintainer who will probably be
able to
> give us the definitive word.
The init script doesn''t use any lock file. The debian package provides
a
custom shorewall.conf that agrees with this init script.

p.s.: the last version of shorewall-xxx.deb can be downloaded from
http://idea.sec.dico.unimi.it/~lorenzo/debian/shorewall/

-- lorenzo

On Mon, 2003-10-27 at 14:11, Lorenzo Martignoni wrote:
> > 
> > I''ve copied the Debian Shorewall maintainer who will probably
be able to
> > give us the definitive word.
> 
> The init script doesn''t use any lock file. The debian package
provides a
> custom shorewall.conf that agrees with this init script.
> 
> p.s.: the last version of shorewall-xxx.deb can be downloaded from
> http://idea.sec.dico.unimi.it/~lorenzo/debian/shorewall/
Thanks, Lorenzo

I''ve removed the ersatz comment from shorewall.conf for 1.4.8.

-Tom
-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net

FYI: I did not use the .deb.

I used the ./install.sh from 1.4.7c tarball.

Alex

----- Original Message ----- 
From: "Tom Eastep" <teastep@shorewall.net>
To: "Shorewall Users Mailing List"
<shorewall-users@lists.shorewall.net>
Sent: Monday, October 27, 2003 1:33 PM
Subject: Re: [Shorewall-users] Debian shorewall.conf (1.4.7c) setting
forlock file /var/lock FYI

> Hi Alex,
>
> On Mon, 2003-10-27 at 00:44, Alex Martin wrote:
> > Hello,
> >
> > Concerning Debian(testing) Shorewall(1.4.7c) installs, 
"/var/state" dir
is
> > _not_ guaranteed to exist, while a /var/lock _is_, and a
/var/lock/subsys is
> > _never_.
> >
> > >From /etc/shorewall/shorewall.conf: (1.4.7c)
> >
> > <snip>
> > # SUBSYSTEM LOCK FILE
> > #
> > # Set this to the name of the lock file expected by your init scripts.
For
> > # RedHat, this should be /var/lock/subsys/shorewall. On Debian, it
> > # should be /var/state/shorewall. If your init scripts don''t
use lock
files,
> > # set this to "".
> > #
> > SUBSYSLOCK=/var/lock/subsys/shorewall
> > <snip>
> >
> > I set "SUBSYSLOCK=/var/lock/shorewall"
> >
> > This is not a big issue really, just noticed it (no /var/state) on a
fresh
> > "testing" install. Other Debian boxes indicate that certain
apache mods
> > create the "/var/state" dir. Of course the lock file could
be anywhere,
I
> > don''t know what definitions there are for these
directory''s proper
usages.
> >
> > Just my two late night cents.
>
> Did you use the .deb or ???
>
> I''m asking to be certain if you are reporting about a stale
comment in
> shorewall.conf (since I''m pretty sure that at one time, Debian did
use
> that directory for init''s lock files) or if you are reporting
> non-standard behavior of the .deb.
>
> SUBSYSLOCK should point to wherever ''init'' looks for lock
files; if your
> ''init'' doesn''t use them then there is no point
in setting the variable.
>
> -Tom
> -- 
> Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
> Shoreline,     \ http://shorewall.net
> Washington USA  \ teastep@shorewall.net
>
>
> _______________________________________________
> Shorewall-users mailing list
> Post: Shorewall-users@lists.shorewall.net
> Subscribe/Unsubscribe:
https://lists.shorewall.net/mailman/listinfo/shorewall-users
> Support: http://www.shorewall.net/support.htm
> FAQ: http://www.shorewall.net/FAQ.htm
>

On Wed, 29 Oct 2003, Alex Martin wrote:
> FYI: I did not use the .deb.
>
> I used the ./install.sh from 1.4.7c tarball.
>
Thanks, Alex.
-Tom
--
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net