FirewallInstaller

1. Overview

The FirewallInstaller module provides a minimal policy utility used by BastionGuard to generate a distro-aware firewall installation command for user guidance.

The module does not execute installation commands. Instead, it returns a best-effort command string suitable for display in the UI (e.g., within FirewallChoiceDialog).

This design preserves strict privilege separation while still offering actionable guidance when no supported firewall backend is detected.

2. Responsibilities

The module is responsible for:

  • Mapping Linux distribution identifiers to package managers
  • Choosing between firewalld and UFW installation strategies
  • Returning a pkexec-wrapped installation command when applicable
  • Failing gracefully (empty string) when no known mapping exists

3. Public API

3.1 getInstallCommand()

Signature:

std::string FirewallInstaller::getInstallCommand(
    const std::string& distro,
    bool preferFirewalld
)

The function returns a shell command string that can be executed by the user to install a supported firewall.

4. Firewall Selection Policy

4.1 firewalld Preference

When preferFirewalld is set to true, the function attempts to select a firewalld-based installation path first.

Supported distributions for firewalld include:

  • Fedora / RHEL / CentOS / openSUSE (DNF-based)
  • Arch Linux / Manjaro (pacman-based)

Returned commands:

pkexec dnf install firewalld
pkexec pacman -S firewalld

If no firewalld mapping exists for the given distribution, the function falls back to UFW logic.

4.2 UFW Fallback Strategy

When firewalld is not preferred or no firewalld mapping is available, the function attempts to return a UFW installation command.

Supported distributions for UFW include:

  • Ubuntu / Debian (APT-based)
  • Arch Linux / Manjaro (pacman-based)

Returned commands:

pkexec apt install ufw
pkexec pacman -S ufw

5. Unsupported Distributions

If the distribution identifier does not match any known mapping, the function returns an empty string:

""

This indicates that no safe or known installation guidance can be provided.

Upstream callers are expected to handle this case by hiding installation actions or presenting a generic message.

6. Integration with FirewallChoiceDialog

This module is typically used in conjunction with FirewallChoiceDialog to:

  • Determine whether an Install firewall button should be displayed
  • Populate the dialog label with a concrete, copy-pasteable command
  • Avoid executing privileged operations directly from the UI

7. Security and Design Considerations

  • No execution: the module never executes shell commands
  • Explicit privilege boundary: commands are returned as strings, wrapped in pkexec for clarity
  • Best-effort mapping: the distro-to-package-manager mapping is intentionally conservative
  • Fail-closed behavior: unknown distributions yield no command rather than a potentially incorrect one
  • Extensibility: additional distributions or firewall backends can be added by extending the mapping logic
Published on:
Last updated on: