# Is there a way to allow an unprivileged process to add or remove IPs from a dedicated firewalld zone? **URL:** \ **Category:** Rocky Linux Help & Support\ **Tags:** rocky-linux-9\ **Created:** [November 7, 2024, 3:08pm UTC](https://forums.rockylinux.org/t/is-there-a-way-to-allow-an-unprivileged-process-to-add-or-remove-ips-from-a-dedicated-firewalld-zone/16422 "2024-11-07T15:08:13Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![cipherpunk](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/cipherpunk/32/4894_2.png) [@cipherpunk](https://forums.rockylinux.org/u/cipherpunk)\ **Post date:** [November 7, 2024, 3:08pm UTC](https://forums.rockylinux.org/t/is-there-a-way-to-allow-an-unprivileged-process-to-add-or-remove-ips-from-a-dedicated-firewalld-zone/16422/1 "2024-11-07T15:08:13Z")
Let’s say I have a custom firewalld zone named `media` with a default policy of `DROP`, and the ports 25000-25100/udp. I have an application running as a user with low privileges, but it needs to be able to add or remove IPs from this `media` zone based on some conditions. It should NOT be able to change ports or add rules or do anything else other than just adding or removing IPs from this zone and this zone only. I could write a script that runs as root and listens for requests from this user and accept only a single parameter (the IP), but I’m not sure if this is the best way or if some kind of API already exists that is better designed than whatever I can come up with. Any advice is appreciated. ---
**Author:** ![hs303](https://avatars.discourse-cdn.com/v4/letter/h/e47774/32.png) [@hs303](https://forums.rockylinux.org/u/hs303)\ **Post date:** [November 7, 2024, 5:20pm UTC](https://forums.rockylinux.org/t/is-there-a-way-to-allow-an-unprivileged-process-to-add-or-remove-ips-from-a-dedicated-firewalld-zone/16422/2 "2024-11-07T17:20:30Z")
What about a short script sanitizing the input to verify it is a valid ip address and then runnning `/usr/bin/firewall-cmd --zone=media --add-source=$1` And then allow the user to execute it with `sudo` `unprivileged_user ALL= NOPASSWD: /path/to/script.sh *` I guess if you properly sanizize the input the `*` should not be a security consideration. Or am I wrong? ---
**Author:** ![cipherpunk](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/cipherpunk/32/4894_2.png) [@cipherpunk](https://forums.rockylinux.org/u/cipherpunk)\ **Post date:** [November 7, 2024, 5:27pm UTC](https://forums.rockylinux.org/t/is-there-a-way-to-allow-an-unprivileged-process-to-add-or-remove-ips-from-a-dedicated-firewalld-zone/16422/3 "2024-11-07T17:27:39Z")
Yes, that will work. Although, since the time I posted this, I found some great examples for dealing directly with netfilter: add rule: [nft-rule-add.c « examples - libnftnl - nftables netlink library](https://git.netfilter.org/libnftnl/tree/examples/nft-rule-add.c) get rule: [nft-rule-get.c « examples - libnftnl - nftables netlink library](https://git.netfilter.org/libnftnl/tree/examples/nft-rule-get.c) del rule: [nft-rule-del.c « examples - libnftnl - nftables netlink library](https://git.netfilter.org/libnftnl/tree/examples/nft-rule-del.c) I’m not too sure if firewall-cmd adds each rule individually, or if it’s adding a set of rules. I’ve to check what exactly it does, but the examples above seems I could compile a binary that has the chain/table hardcoded and will only allow an IP address as the argument. I think this should perform much faster. It’ll be a fun experiment for the day. It should then be okay to give sudo access to run this binary. One thing I’m not very clear about is, if firewall-cmd will see that these changes were made (even though it’s actually active). But I could write an XML file also, just in case firewall-cmd is reloaded then it can reload the rules. ---
**Author:** ![hs303](https://avatars.discourse-cdn.com/v4/letter/h/e47774/32.png) [@hs303](https://forums.rockylinux.org/u/hs303)\ **Post date:** [November 24, 2024, 8:05am UTC](https://forums.rockylinux.org/t/is-there-a-way-to-allow-an-unprivileged-process-to-add-or-remove-ips-from-a-dedicated-firewalld-zone/16422/4 "2024-11-24T08:05:52Z")
I just went over RHEL 9.5 release notes and found this new feature: > **You can use both `firewalld` and `nftables` services simultaneously** > The `firewalld` and `nftables` `systemd` services are available to use simultaneously. Previously, users could enable only one of these services at a time. With this enhancement, these `systemd` services no longer conflict with each other. I guess you’ve already found a working solution and I am not sure if I get it right. But it seems like you could run `firewalld` and make your additions to `nftables` and rely solely on it for those additions and not care about notifiying `firewalld`. > **[Chapter 4. New features | Red Hat Product Documentation](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.5_release_notes/new-features#new-features-networking)** > > Chapter 4. New features | Red Hat Documentation ---
**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/rockylinux/original/1X/91b7219eec10e30013422e4df76c1d898711a5d5.svg) [@system](https://forums.rockylinux.org/u/system)\ **Post date:** [January 23, 2025, 8:06am UTC](https://forums.rockylinux.org/t/is-there-a-way-to-allow-an-unprivileged-process-to-add-or-remove-ips-from-a-dedicated-firewalld-zone/16422/5 "2025-01-23T08:06:21Z")
Closed on January 23, 2025, 8:06am UTC This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.