[AMBARI-17047] Firewall check returns WARNING even if iptables and firewalld are stopped on CentOS7

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: trunk
• Fix Version/s: 2.4.0
• Component/s: ambari-agent, ambari-server
• Labels: patch

Environment

CentOS7.2

• Flags: Patch
• Assignee: Masahiro Tanaka
• Reporter: Masahiro Tanaka
• Created: 05/Jun/16 11:02
• Updated: 12/Jul/16 10:00
• Resolved: 12/Jul/16 08:01

Description

In firewall.py, "systemctl is-active iptables || systemctl is-active firewalld" is passed to run_in_shell function, which splits cmd string by using shlex.split.

run_in_shell function finally calls subprocess.Popen with shell=True, so the cmd string is evaluated like Popen(['/bin/sh', '-c', 'systemctl', 'is-active', 'iptables', '||', 'systemctl', 'is-active', 'firewalld']). This doesn't returns values as expected, because after args[1] (in this case, after the first is-active) are evaluated as sh arguements.

systemctl is-active can take multiple arugments, so we can use it.

Issue Links

• links to: Review Board