meta-nilrt: Integrate firewalld and retire legacy firewall by Vairamani-NI · Pull Request #1030 · ni/meta-nilrt

Vairamani-NI · 2026-06-22T21:30:44Z

Summary of Changes

meta-nilrt: Integrate firewalld and retire legacy firewall

Add firewalld 2.2.1 and ni-firewalld-servicedefs 1.0 to packagegroup-ni-runmode
Remove legacy static iptables firewall init script and SRC_URI references
Migrate ninetcfgutil persistence configuration to firewalld paths
Scoped to runmode images; safemode initramfs unaffected

Replaces legacy iptables-based firewall with modern firewalld daemon.

Justification

https://dev.azure.com/ni/DevCentral/_workitems/edit/3931336
https://dev.azure.com/ni/DevCentral/_workitems/edit/3931337

Testing

Build

Built locally against nilrt/master/next (rebased on kernel 6.18); bitbake -p parses clean (0 errors).
Built the core package feed with this PR in place (bitbake packagefeed-ni-core).
Built the full nilrt-base-system-image (x64) successfully.
Verified all firewalld dependencies are present in the built artifact: firewalld 2.2.1, python3-firewall, ni-firewalld-servicedefs 1.0, nftables 1.1.6, python3-pygobject, python3-dbus.
Confirmed in the rootfs: /etc/init.d/firewalld present, /etc/firewalld/ + ni-*.xml service defs installed, and the legacy /etc/init.d/firewall + rcS.d/S39firewall are gone.

Boot test on hardware — cRIO-9045 (x86_64, NI Linux RT 12.0 "wrynose", kernel 6.12.94-rt18 PREEMPT_RT, run mode)

firewalld starts automatically on boot: /etc/init.d/firewalld status → running, firewall-cmd --state → running.
Enabled via sysvinit: S20firewalld in rc2–5.d, K20firewalld in rc0/1/6.d (registered by firewalld's own update-rc.d firewalld defaults).
Default zone public active (services ssh, dhcpv6-client); nftables backend; table inet firewalld populated with 75 chains; nf_tables/nft_chain_nat/nft_ct modules loaded.
All 15 ni-* service definitions recognized by the daemon.
/var/log/messages clean — no errors/exits
firewalld RSS ≈ 50.8 MB; system available 1661 of 1812 MB.

I have built the core package feed with this PR in place. (bitbake packagefeed-ni-core)

Procedure

I certify that the contents of this pull request complies with the Developer Certificate of Origin.

Copilot

Pull request overview

This PR migrates NILRT runmode images from a legacy iptables-restore SysV init script to firewalld, updating both the runmode package set and the persisted-configuration paths to match firewalld’s configuration locations.

Changes:

Add firewalld and ni-firewalld-servicedefs to the runmode packagegroup.
Remove the legacy /etc/init.d/firewall iptables/ip6tables restore script and its recipe install/rc.d registration.
Update ninetcfgutil persistence to track firewalld configuration paths; adjust ARM distro opt-outs to keep gobject-introspection-data available.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
recipes-ni/ni-netcfgutil/files/ninetcfgutil	Updates persisted configuration entries from legacy iptables conf files to firewalld-related paths.
recipes-ni/initscripts-nilrt/initscripts-nilrt.bb	Stops installing/enabling the legacy `firewall` SysV init script.
recipes-ni/initscripts-nilrt/files/firewall	Removes the legacy iptables/ip6tables restore/clear init script.
recipes-core/packagegroups/packagegroup-ni-runmode.bb	Pulls firewalld (and NI service definitions) into runmode images.
conf/distro/nilrt.inc	Adjusts ARM feature opt-outs to avoid dropping `gobject-introspection-data`, which firewalld depends on.

Comments suppressed due to low confidence (1)

recipes-ni/initscripts-nilrt/initscripts-nilrt.bb:61

NILRT is configured to use sysvinit (conf/distro/nilrt.inc sets VIRTUAL-RUNTIME_init_manager = "sysvinit"). This PR removes the legacy /etc/init.d/firewall startup, but I don't see any replacement SysV init script or update-rc.d enablement for firewalld in this layer. On sysvinit images this can result in firewalld never starting at boot, effectively leaving the system without the intended firewall enforcement.

Consider adding a SysV init script for firewalld (or a lightweight wrapper that starts/stops /usr/sbin/firewalld) and enabling it via update-rc.d, or adding a bbappend to the firewalld recipe that installs/enables a SysV init script when sysvinit is the init manager.

	update-rc.d -r ${D} cleanvarcache         start 38 0 6 S .
	update-rc.d -r ${D} mountconfig           start 35 S .
	update-rc.d -r ${D} niconfiguretracefs    start 82 S .
	update-rc.d -r ${D} nicheckbiosconfig     start 99 4 5 .
	update-rc.d -r ${D} nicleanefivars        start 10 S .

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

chaitu236

We had some action items regarding storage size, testing on ARM, safemode support, etc. Waiting until those are done.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

recipes-ni/initscripts-nilrt/initscripts-nilrt.bb:69

nilrt.inc sets VIRTUAL-RUNTIME_init_manager = "sysvinit" (conf/distro/nilrt.inc:81). This recipe removes the legacy /etc/init.d/firewall install + update-rc.d registration, but this PR does not add any SysV init integration to ensure firewalld is started at boot. If the upstream firewalld recipe only installs a systemd unit (common), runmode images could boot with no firewall service running.

Please add/verify a SysV init path for firewalld on NILRT (e.g., a firewalld_%.bbappend that installs an init.d script + INITSCRIPT_*, or a NILRT-specific init script that starts/stops firewalld) and ensure it is enabled by default.

do_install () {
	install -d ${D}${sysconfdir}/init.d/
	install -m 0755 ${S}/cleanvarcache         ${D}${sysconfdir}/init.d
	install -m 0755 ${S}/mountconfig           ${D}${sysconfdir}/init.d
	install -m 0755 ${S}/niconfiguretracefs    ${D}${sysconfdir}/init.d
	install -m 0755 ${S}/nicheckbiosconfig     ${D}${sysconfdir}/init.d
	install -m 0755 ${S}/nicleanefivars        ${D}${sysconfdir}/init.d
	install -m 0755 ${S}/nicleanstalelinks     ${D}${sysconfdir}/init.d
	install -m 0755 ${S}/nidisablecstates      ${D}${sysconfdir}/init.d
	install -m 0755 ${S}/nipopulateconfigdir   ${D}${sysconfdir}/init.d
	install -m 0755 ${S}/nisetcommitratio      ${D}${sysconfdir}/init.d
	install -m 0755 ${S}/nisetreboottype       ${D}${sysconfdir}/init.d
	install -m 0755 ${S}/nisetupkernelconfig   ${D}${sysconfdir}/init.d
	install -m 0755 ${S}/populateconfig        ${D}${sysconfdir}/init.d
	install -m 0755 ${S}/wirelesssetdomain     ${D}${sysconfdir}/init.d

	update-rc.d -r ${D} cleanvarcache         start 38 0 6 S .
	update-rc.d -r ${D} mountconfig           start 35 S .
	update-rc.d -r ${D} niconfiguretracefs    start 82 S .
	update-rc.d -r ${D} nicheckbiosconfig     start 99 4 5 .
	update-rc.d -r ${D} nicleanefivars        start 10 S .
	update-rc.d -r ${D} nicleanstalelinks     start 5  S .
	update-rc.d -r ${D} nidisablecstates      start 2 3 4 5 S .
	update-rc.d -r ${D} nipopulateconfigdir   start 35 S .
	update-rc.d -r ${D} nisetcommitratio      start 99 S .
	update-rc.d -r ${D} nisetreboottype       stop  55 6 .
	update-rc.d -r ${D} nisetupkernelconfig   start 3  5 .
	update-rc.d -r ${D} populateconfig        start 35 S . start 30 0 6 .
	update-rc.d -r ${D} wirelesssetdomain     start 36 S .

Vairamani-NI · 2026-07-07T10:04:47Z

We had some action items regarding storage size, testing on ARM, safemode support, etc. Waiting until those are done.

@chaitu236 I have reverted the arm32 changes for firewalld using iptables, shall we proceed with these changes (firewalld work only on x64) or hold until arm32 kernel bump?

chaitu236

Please split into multiple commits so that each accomplishes one thing. e.g., one commit to remove legacy firewall, one to add new firewall, etc.

chaitu236 · 2026-07-07T22:28:54Z

We had some action items regarding storage size, testing on ARM, safemode support, etc. Waiting until those are done.

@chaitu236 I have reverted the arm32 changes for firewalld using iptables, shall we proceed with these changes (firewalld work only on x64) or hold until arm32 kernel bump?

As discussed today, let's only implement for x64 until arm kernel is upgraded.

Remove the static iptables-based firewall SysV init script along with its SRC_URI reference, install step, configfs path substitution, sanity check, and update-rc.d registration in initscripts-nilrt. This retires the legacy static firewall ruleset to make way for the firewalld daemon. Scoped to runmode images; safemode initramfs unaffected. Signed-off-by: vairamani muthusamy <vairamani.muthusamy@emerson.com>

Add firewalld 2.2.1 and ni-firewalld-servicedefs to packagegroup-ni-runmode, and migrate ninetcfgutil persistence configuration from the static iptables.conf/ip6tables.conf paths to the firewalld configuration directories (etc/firewalld, etc/sysconfig/firewalld). Provides a modern, dynamically managed firewall daemon in place of the retired legacy iptables init script. Scoped to runmode images; safemode initramfs unaffected. Signed-off-by: vairamani muthusamy <vairamani.muthusamy@emerson.com>

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

Vairamani-NI · 2026-07-08T20:34:02Z

Please split into multiple commits so that each accomplishes one thing. e.g., one commit to remove legacy firewall, one to add new firewall, etc.

Done, I have rebased and built it again too. Pls approve to merge.

chaitu236

Approved conditional on BSI being bootable and firewalld working.

@rajendra-desai-ni

Vairamani-NI force-pushed the add-firewalld branch 2 times, most recently from 0ad457d to 75a12ab Compare June 23, 2026 09:38

shubhanshumt26 requested a review from a team June 25, 2026 05:15

Vairamani-NI marked this pull request as ready for review June 25, 2026 12:23

Copilot AI review requested due to automatic review settings June 25, 2026 12:23

Copilot started reviewing on behalf of Vairamani-NI June 25, 2026 12:23 View session

Copilot AI reviewed Jun 25, 2026

View reviewed changes

chaitu236 requested changes Jul 1, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 7, 2026 09:23

Vairamani-NI force-pushed the add-firewalld branch from 08216ca to 75a12ab Compare July 7, 2026 09:23

Copilot started reviewing on behalf of Vairamani-NI July 7, 2026 09:23 View session

Copilot AI reviewed Jul 7, 2026

View reviewed changes

Vairamani-NI requested a review from chaitu236 July 7, 2026 14:24

chaitu236 requested changes Jul 7, 2026

View reviewed changes

Vairamani-NI added 2 commits July 8, 2026 13:00

Copilot AI review requested due to automatic review settings July 8, 2026 20:28

Vairamani-NI force-pushed the add-firewalld branch from 75a12ab to 1845620 Compare July 8, 2026 20:28

Copilot started reviewing on behalf of Vairamani-NI July 8, 2026 20:29 View session

Vairamani-NI requested a review from chaitu236 July 8, 2026 20:32

Copilot AI reviewed Jul 8, 2026

View reviewed changes

Comment thread recipes-ni/initscripts-nilrt/initscripts-nilrt.bb

chaitu236 approved these changes Jul 9, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

meta-nilrt: Integrate firewalld and retire legacy firewall#1030

meta-nilrt: Integrate firewalld and retire legacy firewall#1030
Vairamani-NI wants to merge 2 commits into
ni:nilrt/master/nextfrom
Vairamani-NI:add-firewalld

Vairamani-NI commented Jun 22, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

chaitu236 left a comment •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Vairamani-NI commented Jul 7, 2026

Uh oh!

chaitu236 left a comment

Uh oh!

chaitu236 commented Jul 7, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Vairamani-NI commented Jul 8, 2026

Uh oh!

chaitu236 left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Vairamani-NI commented Jun 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary of Changes

Justification

Testing

Procedure

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

chaitu236 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Vairamani-NI commented Jul 7, 2026

Uh oh!

chaitu236 left a comment

Choose a reason for hiding this comment

Uh oh!

chaitu236 commented Jul 7, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Vairamani-NI commented Jul 8, 2026

Uh oh!

chaitu236 left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Vairamani-NI commented Jun 22, 2026 •

edited

Loading

chaitu236 left a comment •

edited

Loading