feat(firewalld): configuration to open unprivileged ports by default

[Copilot]

This PR configures firewalld to open unprivileged ports (1024-65535) by default, matching Fedora Workstation's approach. This enables desktop applications like LocalSend to work out of the box without requiring manual firewall configuration.

Changes Made

Firewall Zone Configuration:

• Added FedoraWorkstation.xml zone definition that allows TCP/UDP ports 1024-65535
• Includes essential services: dhcpv6-client, ssh, samba-client
• Blocks privileged ports (1-1023) except for explicitly allowed services

System Configuration:

• Set FedoraWorkstation as the default firewall zone in firewalld.conf
• Added explicit firewalld package installation to ensure availability
• Enabled firewalld service to start automatically on boot

Security Model

This maintains a secure-by-default approach while enabling desktop functionality:

• ✅ All unprivileged ports (1024+) open for incoming connections
• ✅ Essential services (SSH, DHCP, Samba client) allowed
• ❌ Privileged ports (1-1023) blocked except for allowed services
• ❌ No changes to outgoing connection restrictions

Benefits

Applications that will work out of the box:

• LocalSend - Cross-platform file sharing
• Development servers - Running on ports 8080, 3000, etc.
• P2P applications - Using dynamic high port ranges
• Local media servers - Network streaming applications

This brings Bluefin LTS in line with Fedora Workstation's user-friendly firewall policy while maintaining the same security boundaries.

Fixes #715.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• cdn01.quay.io
  • Triggering command: podman build --build-arg MAJOR_VERSION=stream10 --build-arg IMAGE_NAME=bluefin --build-arg IMAGE_VENDOR=ublue-os --build-arg ENABLE_DX=0 --build-arg ENABLE_GDX=0 --build-arg ENABLE_HWE=0 --build-arg SHA_HEAD_SHORT=a708a00 --pull=newer --tag bluefin:lts . (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

Pull Request Overview

This PR configures firewalld to provide a more desktop-friendly firewall configuration by opening unprivileged ports (1024-65535) by default, following Fedora Workstation's approach. This enables applications like LocalSend and development servers to work without manual firewall configuration while maintaining security for privileged ports.

Key changes:

• Added custom FedoraWorkstation firewall zone that allows unprivileged ports while blocking privileged ones
• Configured firewalld as the default zone and enabled the service
• Added firewalld package installation to the build process

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
system_files/usr/lib/firewalld/zones/FedoraWorkstation.xml	Defines custom firewall zone allowing unprivileged ports 1024-65535 and essential services
system_files/etc/firewalld/firewalld.conf	Sets Workstation as the default firewall zone with standard firewalld configuration
build_scripts/40-services.sh	Enables firewalld service to start automatically on boot
build_scripts/20-packages.sh	Adds firewalld package to the installation list

[castrojo]

Can we keep it as Workstation to keep it generic? I'd like to reuse this config in the wolfi port too.

[hanthor]

Verified this is the same config in fedora workstation

[hanthor]

AI-enabled DadOps

[castrojo]

When they come for us, they will come through this firewall.

[gbrsni]

We should probably consider explicitly including mDNS too as a service that is open by default. Being on port 5353 it will be open with this config, but maybe adding it as an explicit service might prevent people from unintentionally closing it?

I found that it makes certain printers (Epson in my case) plug-and-play without needing any drivers.

[dosubot]

Documentation Updates

1 document(s) were updated by changes in this PR:

bluefin

• Bluefin LTS Errata (View Changes)

^{How did I do? Any feedback?}