Fabre

#1142567 ferm fails to start with CACHE=yes #1142567

Package:: ferm

Source:: ferm

Submitter:: Aurelien Jarno

Date:: 2026-08-29 12:51:02 UTC

Severity:: normal

Tags:

#1142567#5

Date:: 2026-07-21 22:30:11 UTC

From:

To:

Dear maintainer,

When CACHE=yes in etc/default/ferm, ferm fails to start:

Jul 21 21:44:46 loongson-conova-02 systemd[1]: Starting ferm.service - Firewall configuration with ferm...
Jul 21 21:44:46 loongson-conova-02 ferm-systemd[811]: Regenerating ferm cache... /usr/sbin/ferm   --shell /etc/ferm/ferm.conf to /var/cache/ferm/-etc-ferm-ferm.conf.sh.tmp
Jul 21 21:44:47 loongson-conova-02 ferm-systemd[815]: Unknown option: s
Jul 21 21:44:47 loongson-conova-02 systemd[1]: ferm.service: Main process exited, code=exited, status=2/INVALIDARGUMENT
Jul 21 21:44:47 loongson-conova-02 systemd[1]: ferm.service: Failed with result 'exit-code'.
Jul 21 21:44:47 loongson-conova-02 systemd[1]: Failed to start ferm.service - Firewall configuration with ferm.

There is an obvious dash missing before "-shell" in
/usr/libexec/ferm/ferm-systemd activate, but unfortunately adding it is
not enough to fix the issue.

Regards
Aurelien

#1142567#10

Date:: 2026-07-23 21:40:15 UTC

From:

To:

Hi Aurelien,

thank you for using ferm and my apologies for the problems you have.

Witout having plunged into the issue deeply yet,

The problem is that the DEBUG stanza was pasted in between the two
dashes of --shell, so you'd need to remove the - before the ${DEBUG
part.

Does that fix your issue already?

Greetings
Marc

#1142567#15

Date:: 2026-07-23 21:40:15 UTC

From:

To:

Hi Aurelien,

thank you for using ferm and my apologies for the problems you have.

Witout having plunged into the issue deeply yet,

The problem is that the DEBUG stanza was pasted in between the two
dashes of --shell, so you'd need to remove the - before the ${DEBUG
part.

Does that fix your issue already?

Greetings
Marc

#1142567#20

Date:: 2026-07-26 12:46:08 UTC

From:

To:

Hi Marc,

It makes things better, but there are still more issues, introduced by
patches 0009-add-verbose-option-for-bette-debugging.patch and
0011-better-debug-output-regarding-flie-open.patch:

juil. 26 14:29:35 scratch ferm-systemd[3861]: Cache generated successfully. Now using fresh cache to activate rules
juil. 26 14:29:35 scratch ferm-systemd[3872]: /var/cache/ferm/-etc-ferm-ferm.conf.sh: line 1: piping: command not found
juil. 26 14:29:35 scratch ferm-systemd[3873]: /var/cache/ferm/-etc-ferm-ferm.conf.sh: line 2: piping: command not found
juil. 26 14:29:35 scratch ferm-systemd[3861]: /var/cache/ferm/-etc-ferm-ferm.conf.sh: line 24: syntax error near unexpected token `running'
juil. 26 14:29:35 scratch ferm-systemd[3861]: /var/cache/ferm/-etc-ferm-ferm.conf.sh: line 24: `running /usr/sbin/iptables-restore for restore'

At the end the patch below is enough to get ferm starting, but I am not
sure about the fix to the ferm binary, nor I am not sure it fixes all
the cases.

Regards
Aurelien
--- /usr/libexec/ferm/ferm-systemd
+++ /usr/libexec/ferm/ferm-systemd
@@ -138,7 +138,7 @@
             echo "Regenerating ferm cache... ${FERM} ${OPTIONS} ${DEBUG:+--lines --verbose} --shell ${CONFIG} to ${CACHE_FILE}.tmp"
             rm -f "${CACHE_FILE}" "${CACHE_FILE}.tmp" "${KERNEL_FILE}"

-            "${FERM}" ${OPTIONS} -${DEBUG:+--lines --verbose} -shell "${CONFIG}" > "${CACHE_FILE}.tmp" || return $?
+            "${FERM}" ${OPTIONS} ${DEBUG:+--lines --verbose} --shell "${CONFIG}" > "${CACHE_FILE}.tmp" || return $?

             cp /proc/version "${KERNEL_FILE}"
             mv "${CACHE_FILE}.tmp" "${CACHE_FILE}" || return $?
--- /usr/sbin/ferm
+++ /usr/sbin/ferm
@@ -986,7 +986,7 @@
     } elsif (exists $tools{'tables-save'} &&
             open(SAVE, "$tools{'tables-save'}|")) {
         # for rollback
-        print LINES "piping to tools tables-save: ". $tools{'tables-save'}. "\n";
+        print LINES "# piping to tools tables-save: ". $tools{'tables-save'}. "\n";
         $domain_info->{previous} = read_previous(\*SAVE, $domain_info);
     }

@@ -3140,7 +3140,7 @@
     $path .= " --noflush" if $option{noflush};

     local *RESTORE;
-    print LINES "running $path for restore\n";
+    print LINES "# running $path for restore\n";
     open RESTORE, "|$path"
       or die "Failed to run $path: $!\n";

@@ -3168,7 +3168,7 @@
     return if $option{noexec};

     eval {
-        print LINES "restore_domain()\n"
+        print LINES "# restore_domain()\n"
             if $option{lines};
         restore_domain($domain_info, $save);
     };

#1142567#23

Date:: 2026-07-26 12:46:08 UTC

From:

To:

Hi Marc,

It makes things better, but there are still more issues, introduced by
patches 0009-add-verbose-option-for-bette-debugging.patch and
0011-better-debug-output-regarding-flie-open.patch:

juil. 26 14:29:35 scratch ferm-systemd[3861]: Cache generated successfully. Now using fresh cache to activate rules
juil. 26 14:29:35 scratch ferm-systemd[3872]: /var/cache/ferm/-etc-ferm-ferm.conf.sh: line 1: piping: command not found
juil. 26 14:29:35 scratch ferm-systemd[3873]: /var/cache/ferm/-etc-ferm-ferm.conf.sh: line 2: piping: command not found
juil. 26 14:29:35 scratch ferm-systemd[3861]: /var/cache/ferm/-etc-ferm-ferm.conf.sh: line 24: syntax error near unexpected token `running'
juil. 26 14:29:35 scratch ferm-systemd[3861]: /var/cache/ferm/-etc-ferm-ferm.conf.sh: line 24: `running /usr/sbin/iptables-restore for restore'

At the end the patch below is enough to get ferm starting, but I am not
sure about the fix to the ferm binary, nor I am not sure it fixes all
the cases.

Regards
Aurelien
--- /usr/libexec/ferm/ferm-systemd
+++ /usr/libexec/ferm/ferm-systemd
@@ -138,7 +138,7 @@
             echo "Regenerating ferm cache... ${FERM} ${OPTIONS} ${DEBUG:+--lines --verbose} --shell ${CONFIG} to ${CACHE_FILE}.tmp"
             rm -f "${CACHE_FILE}" "${CACHE_FILE}.tmp" "${KERNEL_FILE}"

-            "${FERM}" ${OPTIONS} -${DEBUG:+--lines --verbose} -shell "${CONFIG}" > "${CACHE_FILE}.tmp" || return $?
+            "${FERM}" ${OPTIONS} ${DEBUG:+--lines --verbose} --shell "${CONFIG}" > "${CACHE_FILE}.tmp" || return $?

             cp /proc/version "${KERNEL_FILE}"
             mv "${CACHE_FILE}.tmp" "${CACHE_FILE}" || return $?
--- /usr/sbin/ferm
+++ /usr/sbin/ferm
@@ -986,7 +986,7 @@
     } elsif (exists $tools{'tables-save'} &&
             open(SAVE, "$tools{'tables-save'}|")) {
         # for rollback
-        print LINES "piping to tools tables-save: ". $tools{'tables-save'}. "\n";
+        print LINES "# piping to tools tables-save: ". $tools{'tables-save'}. "\n";
         $domain_info->{previous} = read_previous(\*SAVE, $domain_info);
     }

@@ -3140,7 +3140,7 @@
     $path .= " --noflush" if $option{noflush};

     local *RESTORE;
-    print LINES "running $path for restore\n";
+    print LINES "# running $path for restore\n";
     open RESTORE, "|$path"
       or die "Failed to run $path: $!\n";

@@ -3168,7 +3168,7 @@
     return if $option{noexec};

     eval {
-        print LINES "restore_domain()\n"
+        print LINES "# restore_domain()\n"
             if $option{lines};
         restore_domain($domain_info, $save);
     };

#1142567#26

Date:: 2026-08-04 05:14:50 UTC

From:

To:

Hello,

Bug #1142567 in ferm reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/debian/ferm/-/commit/d86bdeb9875295d058c57d5096d44e54e7e53a63
------------------------------------------------------------------------
fix paste error and wrongly set dash

Thanks: Aurelien Jarno
Closes: #1142567
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1142567

#1142567#33

Date:: 2026-08-29 12:48:52 UTC

From:

To:

We believe that the bug you reported is fixed in the latest version of
ferm, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1142567@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Marc Haber <mh+debian-packages@zugschlus.de> (supplier of updated ferm package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 29 Aug 2026 13:53:22 +0200
Source: ferm
Architecture: source
Version: 2.7-9
Distribution: unstable
Urgency: medium
Maintainer: Debian Ferm Maintainers <ferm@packages.debian.org>
Changed-By: Marc Haber <mh+debian-packages@zugschlus.de>
Closes: 1142567
Changes:
 ferm (2.7-9) unstable; urgency=medium
 .
   * add autopkgtests for the cache case
   * remove debug output that ended up in iptables-save cache.
     Thanks to Aurelien Jarno (Closes: 1142567)
   * fix paste error and wrongly set dash.
     Thanks to Aurelien Jarno (Closes: #1142567)
   * Change to debhelper-compat 14
   * create /var/lib/ferm cache dirs via tmpfiles
   * improve debugging in ferm-systemd
Checksums-Sha1:
 0160290c385daf0c04755f2ca8f5fbc9ad39386d 1508 ferm_2.7-9.dsc
 bace6fcdaee29c087496d0db5da19430b2d5dd9e 30036 ferm_2.7-9.debian.tar.xz
Checksums-Sha256:
 0516498d4c323ed4788bf5b7c6b0205b911bf866d8e2417b7acc02dcdf0b607c 1508 ferm_2.7-9.dsc
 92e729540f9f10e4b1555d053da3dc6e1e83a8c1b57ed11be42a1b53de47ca7f 30036 ferm_2.7-9.debian.tar.xz
Files:
 4d9dc19fb874779a95ef2e2c304d0372 1508 net optional ferm_2.7-9.dsc
 967662629a09b40342afc8541e668978 30036 net optional ferm_2.7-9.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQRoUtdjQYCq5giMg+rVTTAMN2ORyQUCapLSwgAKCRDVTTAMN2OR
yfHxAP9m0xGx0w6FxYvcJNgyvvBm2tNHm5VKkFhZZexzUucNRQD+PtG5yOlawFel
UV8if5h3/y6A/3lUjQygxPWhi40sLAY=
=yW1P
-----END PGP SIGNATURE-----

#1142567 ferm fails to start with CACHE=yes #1142567

Just Reply to ...

Reply to submitter ...

Send control command (Silently)

Set Architecture Tags (Silently)