Fabre

#1142567 ferm fails to start with CACHE=yes #1142567

Package:: ferm

Source:: ferm

Submitter:: Aurelien Jarno

Date:: 2026-08-04 05:17:01 UTC

Severity:: normal

Tags:

#1142567#5

Date:: 2026-07-21 22:30:11 UTC

From:

To:

Dear maintainer,

When CACHE=yes in etc/default/ferm, ferm fails to start:

Jul 21 21:44:46 loongson-conova-02 systemd[1]: Starting ferm.service - Firewall configuration with ferm...
Jul 21 21:44:46 loongson-conova-02 ferm-systemd[811]: Regenerating ferm cache... /usr/sbin/ferm   --shell /etc/ferm/ferm.conf to /var/cache/ferm/-etc-ferm-ferm.conf.sh.tmp
Jul 21 21:44:47 loongson-conova-02 ferm-systemd[815]: Unknown option: s
Jul 21 21:44:47 loongson-conova-02 systemd[1]: ferm.service: Main process exited, code=exited, status=2/INVALIDARGUMENT
Jul 21 21:44:47 loongson-conova-02 systemd[1]: ferm.service: Failed with result 'exit-code'.
Jul 21 21:44:47 loongson-conova-02 systemd[1]: Failed to start ferm.service - Firewall configuration with ferm.

There is an obvious dash missing before "-shell" in
/usr/libexec/ferm/ferm-systemd activate, but unfortunately adding it is
not enough to fix the issue.

Regards
Aurelien

#1142567#10

Date:: 2026-07-23 21:40:15 UTC

From:

To:

Hi Aurelien,

thank you for using ferm and my apologies for the problems you have.

Witout having plunged into the issue deeply yet,

The problem is that the DEBUG stanza was pasted in between the two
dashes of --shell, so you'd need to remove the - before the ${DEBUG
part.

Does that fix your issue already?

Greetings
Marc

#1142567#15

Date:: 2026-07-23 21:40:15 UTC

From:

To:

Hi Aurelien,

thank you for using ferm and my apologies for the problems you have.

Witout having plunged into the issue deeply yet,

The problem is that the DEBUG stanza was pasted in between the two
dashes of --shell, so you'd need to remove the - before the ${DEBUG
part.

Does that fix your issue already?

Greetings
Marc

#1142567#20

Date:: 2026-07-26 12:46:08 UTC

From:

To:

Hi Marc,

It makes things better, but there are still more issues, introduced by
patches 0009-add-verbose-option-for-bette-debugging.patch and
0011-better-debug-output-regarding-flie-open.patch:

juil. 26 14:29:35 scratch ferm-systemd[3861]: Cache generated successfully. Now using fresh cache to activate rules
juil. 26 14:29:35 scratch ferm-systemd[3872]: /var/cache/ferm/-etc-ferm-ferm.conf.sh: line 1: piping: command not found
juil. 26 14:29:35 scratch ferm-systemd[3873]: /var/cache/ferm/-etc-ferm-ferm.conf.sh: line 2: piping: command not found
juil. 26 14:29:35 scratch ferm-systemd[3861]: /var/cache/ferm/-etc-ferm-ferm.conf.sh: line 24: syntax error near unexpected token `running'
juil. 26 14:29:35 scratch ferm-systemd[3861]: /var/cache/ferm/-etc-ferm-ferm.conf.sh: line 24: `running /usr/sbin/iptables-restore for restore'

At the end the patch below is enough to get ferm starting, but I am not
sure about the fix to the ferm binary, nor I am not sure it fixes all
the cases.

Regards
Aurelien
--- /usr/libexec/ferm/ferm-systemd
+++ /usr/libexec/ferm/ferm-systemd
@@ -138,7 +138,7 @@
             echo "Regenerating ferm cache... ${FERM} ${OPTIONS} ${DEBUG:+--lines --verbose} --shell ${CONFIG} to ${CACHE_FILE}.tmp"
             rm -f "${CACHE_FILE}" "${CACHE_FILE}.tmp" "${KERNEL_FILE}"

-            "${FERM}" ${OPTIONS} -${DEBUG:+--lines --verbose} -shell "${CONFIG}" > "${CACHE_FILE}.tmp" || return $?
+            "${FERM}" ${OPTIONS} ${DEBUG:+--lines --verbose} --shell "${CONFIG}" > "${CACHE_FILE}.tmp" || return $?

             cp /proc/version "${KERNEL_FILE}"
             mv "${CACHE_FILE}.tmp" "${CACHE_FILE}" || return $?
--- /usr/sbin/ferm
+++ /usr/sbin/ferm
@@ -986,7 +986,7 @@
     } elsif (exists $tools{'tables-save'} &&
             open(SAVE, "$tools{'tables-save'}|")) {
         # for rollback
-        print LINES "piping to tools tables-save: ". $tools{'tables-save'}. "\n";
+        print LINES "# piping to tools tables-save: ". $tools{'tables-save'}. "\n";
         $domain_info->{previous} = read_previous(\*SAVE, $domain_info);
     }

@@ -3140,7 +3140,7 @@
     $path .= " --noflush" if $option{noflush};

     local *RESTORE;
-    print LINES "running $path for restore\n";
+    print LINES "# running $path for restore\n";
     open RESTORE, "|$path"
       or die "Failed to run $path: $!\n";

@@ -3168,7 +3168,7 @@
     return if $option{noexec};

     eval {
-        print LINES "restore_domain()\n"
+        print LINES "# restore_domain()\n"
             if $option{lines};
         restore_domain($domain_info, $save);
     };

#1142567#23

Date:: 2026-07-26 12:46:08 UTC

From:

To:

Hi Marc,

It makes things better, but there are still more issues, introduced by
patches 0009-add-verbose-option-for-bette-debugging.patch and
0011-better-debug-output-regarding-flie-open.patch:

juil. 26 14:29:35 scratch ferm-systemd[3861]: Cache generated successfully. Now using fresh cache to activate rules
juil. 26 14:29:35 scratch ferm-systemd[3872]: /var/cache/ferm/-etc-ferm-ferm.conf.sh: line 1: piping: command not found
juil. 26 14:29:35 scratch ferm-systemd[3873]: /var/cache/ferm/-etc-ferm-ferm.conf.sh: line 2: piping: command not found
juil. 26 14:29:35 scratch ferm-systemd[3861]: /var/cache/ferm/-etc-ferm-ferm.conf.sh: line 24: syntax error near unexpected token `running'
juil. 26 14:29:35 scratch ferm-systemd[3861]: /var/cache/ferm/-etc-ferm-ferm.conf.sh: line 24: `running /usr/sbin/iptables-restore for restore'

At the end the patch below is enough to get ferm starting, but I am not
sure about the fix to the ferm binary, nor I am not sure it fixes all
the cases.

Regards
Aurelien
--- /usr/libexec/ferm/ferm-systemd
+++ /usr/libexec/ferm/ferm-systemd
@@ -138,7 +138,7 @@
             echo "Regenerating ferm cache... ${FERM} ${OPTIONS} ${DEBUG:+--lines --verbose} --shell ${CONFIG} to ${CACHE_FILE}.tmp"
             rm -f "${CACHE_FILE}" "${CACHE_FILE}.tmp" "${KERNEL_FILE}"

-            "${FERM}" ${OPTIONS} -${DEBUG:+--lines --verbose} -shell "${CONFIG}" > "${CACHE_FILE}.tmp" || return $?
+            "${FERM}" ${OPTIONS} ${DEBUG:+--lines --verbose} --shell "${CONFIG}" > "${CACHE_FILE}.tmp" || return $?

             cp /proc/version "${KERNEL_FILE}"
             mv "${CACHE_FILE}.tmp" "${CACHE_FILE}" || return $?
--- /usr/sbin/ferm
+++ /usr/sbin/ferm
@@ -986,7 +986,7 @@
     } elsif (exists $tools{'tables-save'} &&
             open(SAVE, "$tools{'tables-save'}|")) {
         # for rollback
-        print LINES "piping to tools tables-save: ". $tools{'tables-save'}. "\n";
+        print LINES "# piping to tools tables-save: ". $tools{'tables-save'}. "\n";
         $domain_info->{previous} = read_previous(\*SAVE, $domain_info);
     }

@@ -3140,7 +3140,7 @@
     $path .= " --noflush" if $option{noflush};

     local *RESTORE;
-    print LINES "running $path for restore\n";
+    print LINES "# running $path for restore\n";
     open RESTORE, "|$path"
       or die "Failed to run $path: $!\n";

@@ -3168,7 +3168,7 @@
     return if $option{noexec};

     eval {
-        print LINES "restore_domain()\n"
+        print LINES "# restore_domain()\n"
             if $option{lines};
         restore_domain($domain_info, $save);
     };

#1142567#26

Date:: 2026-08-04 05:14:50 UTC

From:

To:

Hello,

Bug #1142567 in ferm reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/debian/ferm/-/commit/d86bdeb9875295d058c57d5096d44e54e7e53a63
------------------------------------------------------------------------
fix paste error and wrongly set dash

Thanks: Aurelien Jarno
Closes: #1142567
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1142567

#1142567 ferm fails to start with CACHE=yes #1142567

Just Reply to ...

Reply to submitter ...

Send control command (Silently)

Set Architecture Tags (Silently)