Public bug reported: [Availability] - Source: iptables-persistent, version 1.0.20; currently in Ubuntu universe. - Binaries: iptables-persistent, netfilter-persistent, ipset-persistent. - Launchpad: https://launchpad.net/ubuntu/+source/iptables-persistent
[Rationale] - Required for Anthos networking: CNI networking depends on firewall rules persisting across reboots. - An OSCAP rule used for CIS hardening checks that this package is installed. - Source: Google partner issue tracker, component "Anthos On-VMware" (issue 434757237, "[Anthos on-VMware] request iptables-persistent package to be installed", filed Jul 2025). Summary: a partner requested iptables-persistent be included in Anthos-on-VMware Ubuntu images. Canonical confirmed it shipped starting with the image builds published 27 Aug 2025 (Ubuntu 22.04 Anthos-on-VMware 1.28-1.32, Ubuntu 24.04 Anthos-on-VMware 1.33), and the request was marked Fixed. The ticket itself documents the image-level inclusion, not the archive component; main promotion is needed so the package carries the same support/security guarantees as the rest of the image. - Install iptables-persistent alongside netfilter-persistent. - Promote all binaries from this source together. [Security and maintenance] - No package-associated CVEs were found by the queried trackers. - netfilter-persistent.service runs as root and has no systemd hardening directives; the package ships no AppArmor profile. - One open Launchpad bug was reported: LP #2054318, a conffile prompt issue on upgrade in mantic cloud images. No critical Ubuntu or release-critical Debian bugs were found. - License: GPL-3. No expiry or other known encumbrance. [Quality assurance] - Packaging is a native package with a minimal debhelper `debian/rules`; Lintian reported no errors or warnings. - No autopkgtests or upstream test suite were found. - Administrators define the firewall rules; the package persists and restores them. It is installed with netfilter-persistent. [Dependencies] - netfilter-persistent is built from this source and must be promoted with it. - debconf-2.0 was flagged as outside main by the automated report; confirm its provider/component before filing. [Ownership and coordination] - Owning team and Launchpad subscription: Security team. - No definitive deadline, driven by Google partner issue 434757237 priority. - Impact on other Ubuntu teams and coordination: Minimal. - Recent build reference: https://launchpad.net/ubuntu/+source/iptables-persistent/+publishinghistory. [Background] - This is a native Debian package with no separate upstream tarball. No upstream link is available. ** Affects: iptables-persistent (Ubuntu) Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2170829 Title: [MIR] iptables-persistent To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/iptables-persistent/+bug/2170829/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
