Add firewalld configuration override specific to azl by binujp · Pull Request #15648 · microsoft/azurelinux

binujp · 2026-02-02T05:04:02Z

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

Summary

What does the PR accomplish, why was it needed?

Firewalld configuration is driven of a top level config files and then zones tied to some or all interfaces and the zone configuration itself has the rules for the net filters. We are using nftables, an azurelinux zone policy which opens only ssh and optionally dhcpv6-client port. This change adds a sub-package to azurelinux-config which enables all that.

Change Log

Change
Change
Change

Does this affect the toolchain?

YES/NO

Associated issues

#xxxx

Links to CVEs

https://nvd.nist.gov/vuln/detail/CVE-YYYY-XXXX

Test Methodology

Pipeline build id: xxxx

reubeno · 2026-02-02T09:10:27Z

base/comps/azurelinux-config/10-azurelinux-firewalld.preset

@@ -0,0 +1 @@
+enable firewalld.service


Have you looked at the 90-default.preset in azurelinux-release; it's already enabled. I would expect presets go there.

Yes, I saw that presets all go there. My thought was unless azurelinux configuration is available should we enable and start firewalld. If we are sure that is the pattern we want to follow that sounds good.

Those presets were mostly just inherited from Fedora; my recollection is that many services are preset-enabled in base Fedora, independent of product. Presumably the thinking is that a customer who doesn't want to use it can arrange not to install the package (or to remove it).

reubeno · 2026-02-02T09:13:38Z

base/comps/azurelinux-config/50-default.network

@@ -0,0 +1,6 @@
+# We want systemd to manage all interfaces


@ddstreetmicrosoft I believe you had some input on the right approach here, what other distros typically do, etc.?

The most robust approach is to let one framework manage all interfaces. Given we are considering only azure cloud deployments I would rather not complicate things. I see there may be cases where the machine is in a DMZ zone and can have NICs in different networks. Let us consider those as special cases to be handled by the customer.

Ah, I should have clarified. My question was more around blanket DHCP enablement -- not having systemd-networkd manage the network interfaces.

This is definitely wrong

reubeno · 2026-02-02T09:16:25Z

base/images/vm-base/vm-base.kiwi

-    <!--
    <users>
-        <user name="root" password="INSERT-PASSWORD-HERE" groups="root" />
+          <user name="root" password="INSERT-PASSWORD-HERE" groups="root" />


Please remove these changes; you should be able to use cloud-init config to inject user account configs / credentials (e.g., via azldev image boot).

I'm happy to chat separately to get you unblocked with that.

reubeno · 2026-02-02T09:17:02Z

base/images/images.toml

@@ -1,10 +1,10 @@
 [images.vm-base]


Are you up to date with the target branch? These comments were removed last week.

I did rebase, this change was on top of my other PR #15599. Maybe that messed this up? I will check.

reubeno · 2026-02-02T09:17:25Z

scripts/demo-build.sh

 #
 # NOTE: This script is a throwaway script. Please think ~~twice~~ thrice before you
-# consider adding anything to it.
+# consider adding anything to it. Let us push all dev-tooling into azldev.


base/comps/azurelinux-config/azurelinux-firewalld-zone.xml

reubeno · 2026-02-02T09:34:52Z

base/comps/azurelinux-config/azurelinux-config.spec

+
+%install
+install -d %{buildroot}%{_sysconfdir}/systemd/network
+install -m 644 %{_sourcedir}/50-default.network %{buildroot}%{_sysconfdir}/systemd/network/50-default.network


Please see https://docs.fedoraproject.org/en-US/packaging-guidelines/RPM_Source_Dir/

Packages which use files itemized as Source# files, must refer to those files by their %{SOURCE#} macro name, and must not use $RPM_SOURCE_DIR or %{_sourcedir} to refer to those files.

This is done to ensure that Fedora SRPMS are properly generated. If a Source# item is renamed, a spec which refers to its old name may succeed locally (because the file is still in %{_sourcedir} along with the new file), but the proper file will not be included in the SRPM.

TIL something, thanks Reuben!

reubeno · 2026-02-02T09:39:06Z

base/comps/azurelinux-config/azurelinux-config.spec

+BuildArch:      noarch
+
+%description
+Provides AZL specifc configuration overrides via sub-packages. These sub-packages will be pulled in by the relevant owning packages via reverse dependencies.


Typo: specifc

Copilot

Pull request overview

This PR introduces firewalld configuration support for Azure Linux, establishing a zero-trust security posture for VM deployments. The changes enable firewalld with nftables backend and an Azure Linux-specific zone policy that only allows SSH access by default.

Changes:

Added azurelinux-config meta-package with firewalld and systemd-networkd sub-packages for distro-specific configurations
Integrated firewalld into the VM base image with Azure Linux zone policy restricting access to SSH only
Enhanced demo build script to support VM image building and testing with QEMU

Reviewed changes

Copilot reviewed 10 out of 11 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
scripts/demo-build.sh	Extended script to support VM image building, QEMU booting, and added validation checks for prerequisites
distro/azurelinux.distro.toml	Updated RHEL compatibility version from 10 to 11
base/images/vm-base/vm-base.kiwi	Added firewalld packages, increased disk size, and enabled systemd networkd configuration
base/images/images.toml	Uncommented vm-base image definition to enable VM builds
base/comps/components.toml	Registered firewalld component
base/comps/azurelinux-config/firewalld-azurelinux.conf	Added comprehensive firewalld configuration with nftables backend and security settings
base/comps/azurelinux-config/azurelinux-firewalld-zone.xml	Defined Azure Linux firewall zone with SSH-only access policy
base/comps/azurelinux-config/azurelinux-config.spec	Created spec file for azurelinux-config meta-package with firewalld and systemd-networkd sub-packages
base/comps/azurelinux-config/azurelinux-config.comp.toml	Added component definition for azurelinux-config
base/comps/azurelinux-config/50-default.network	Added systemd-networkd configuration to manage all interfaces with DHCP

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-02T20:50:12Z

base/comps/azurelinux-config/azurelinux-config.spec

+ln -sf %{_sysconfdir}/firewalld/firewalld-azurelinux.conf %{_sysconfdir}/firewalld/firewalld.conf
+
+%postun firewalld
+ln -sf %{_sysconfdir}/firewalld/firewalld-standard.conf %{_sysconfdir}/firewalld/firewalld.conf


The %postun script references 'firewalld-standard.conf' which may not exist. When the package is uninstalled, this symlink creation will fail if the target file doesn't exist. Consider verifying the file exists or using a conditional check before creating the symlink.

Suggested change

ln -sf %{_sysconfdir}/firewalld/firewalld-standard.conf %{_sysconfdir}/firewalld/firewalld.conf

if [ -f %{_sysconfdir}/firewalld/firewalld-standard.conf ]; then

ln -sf %{_sysconfdir}/firewalld/firewalld-standard.conf %{_sysconfdir}/firewalld/firewalld.conf

fi

ddstreetmicrosoft · 2026-02-03T15:32:48Z

base/comps/azurelinux-config/azurelinux-config.spec

+%description firewalld
+Provides Azure Linux specific policies and zones for firewalld. 
+
+%install


as with the other PR, distro-provided files should go into /usr/lib; the /etc dir is generally for users/admins

ddstreetmicrosoft · 2026-02-03T15:42:33Z

base/comps/azurelinux-config/firewalld-azurelinux.conf

@@ -0,0 +1,121 @@
+# firewalld config file


I would greatly like to see a PR with individual commits for every single configuration parameter added here, with specific explanation for why we need to add the config

ddstreetmicrosoft · 2026-02-03T15:44:06Z

base/comps/components.toml

 [components.file]
 [components.filesystem]
 [components.findutils]
+[components.firewalld]


Is this PR both adding the firewalld package itself, and adding azl-specific config in a separate package? IMHO simply adding firewalld should be completely separate - that should be simple to review/commit.

ddstreetmicrosoft · 2026-02-03T15:44:47Z

base/images/vm-base/vm-base.kiwi

            format="vhdx"
            initrd_system="dracut"
            filesystem="ext4"
-            kernelcmdline="console=ttyS0 rd.shell=0 systemd.getty_auto=false"


what do these changes have to do with firewalld configuration overrides?

ddstreet · 2026-02-04T15:29:13Z

Similiar to my comment in the networkd pr, I set up a branch that I think logically breaks up this pr into parts, specifically:

feat: add firewalld package to kiwi vm-base definition
ix: remove duplicate systemd-resolved entry from kiwi vm-base definition

i put both of these in a separate pr

update gitignore file
update azurelinux.distro.toml to change rhel from 10->11

these 2 are also in the network pr; i think the gitignore change can wait for @binujp to get back, and the rhel version bump needs explanation

uncomment kiwi vm xml to add definition for root user

this shouldn't be merged, in fact i think the root user definition (even though its commented out) needs to be removed from the file

add azurelinux-config spec file with a definition for azurelinux-config-firewalld

this defines the azurelinux-config rpm (spec and firewall subpackage, plus config files). I do not think this is how we should deliver firewalld configuration; I think we should look at how the firewalld package currently provides distro-provided config, and do something similar.

add systemd-networkd config to azurelinux-config package

this seems to be carried over from the networkd pr, and doesn't belong in this pr

feat: add azurelinux-config packages to kiwi vm-base definition

since I don't think we should create the azurelinux-config package, we don't need to add its rpms to the kiwi vm-base image definition.

update scripts/demo-build.sh

same opinion as the other pr; don't update this script, as it should be removed

ddstreet · 2026-02-04T15:41:03Z

I rebased my branch so the links in the previous comment are stale, but you can go direction to my branch to see the commits:
https://github.com/ddstreet/azurelinux/commits/firewalld-config/

ddstreet · 2026-02-04T21:32:00Z

Ok, after comparing the firewalld-azurelinux.conf and azurelinux-firewalld-zone.xml to what's provided out of the box, there are no differences in the .conf file (besides default zone name pointing to the azurelinux zone), and the azurelinux zone only differs from the standard default zone (public) by closing the mdns and dhcpv6-client ports.

I think we should close this PR and go with the firewalld defaults as currently provided. Closing the dhcpv6-client port in particular will very likely lead to confused and complaining users when their cloud ipv6 configuration doesn't work properly. I don't know how much mdns is used in the cloud, but we can decide to close that later if really needed.

ddstreetmicrosoft · 2026-02-05T21:06:02Z

I opened pr #15740 to remove mdns from the public zone, and am closing this pr

Binu Philip and others added 5 commits January 28, 2026 06:07

Add network overrides and build a qemu image

4ceabf9

rename overrides rpm

e28b546

create azl configuration rpm for opinions

e4fb32c

address copilot comments

d26c2c7

firewalld configuration sub-package azurelinux-config

c5f52bb

binujp requested review from Copilot, reubeno and tobiasb-ms and removed request for Copilot February 2, 2026 05:04

Copilot started reviewing on behalf of binujp February 2, 2026 05:04 View session

reubeno requested changes Feb 2, 2026

View reviewed changes

review feedback: remove preset

bc844f0

Copilot AI review requested due to automatic review settings February 2, 2026 20:49

Copilot AI reviewed Feb 2, 2026

View reviewed changes

ddstreetmicrosoft reviewed Feb 3, 2026

View reviewed changes

ddstreetmicrosoft closed this Feb 5, 2026

Conversation

binujp commented Feb 2, 2026

Merge Checklist

Summary

Change Log

Does this affect the toolchain?

Associated issues

Links to CVEs

Test Methodology

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ddstreet commented Feb 4, 2026

Uh oh!

ddstreet commented Feb 4, 2026

Uh oh!

ddstreet commented Feb 4, 2026

Uh oh!

ddstreetmicrosoft commented Feb 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants