fwupd opens TCP and UDP ports

[mohemiv]

Arch Linux.

Before fwupd:

$ sudo netstat -lup
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
$ sudo netstat -ltp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    

Setting fwupd up:

$ sudo pacman -S fwupd
$ sudo fwupdmgr --version

The result:

$ sudo netstat -lup
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
udp        0      0 0.0.0.0:mdns            0.0.0.0:*                           108754/avahi-daemon 
udp        0      0 0.0.0.0:58195           0.0.0.0:*                           108754/avahi-daemon 
udp6       0      0 [::]:mdns               [::]:*                              108754/avahi-daemon 
udp6       0      0 [::]:47562              [::]:*                              108754/avahi-daemon 
$ sudo netstat -ltp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:27500           0.0.0.0:*               LISTEN      108756/passimd      

Fwupd is a security software that is used to update vulnerable firmware. There is no way it should open 3 ports on my machine.

[hughsie]

That's not fwupd, that's passim -- I assume arch auto-installed it as a recommended package.

[mohemiv]

As far as I understand, fwupd is statically linked with passim, so it can't be installed without it.

https://archlinux.org/packages/extra/x86_64/fwupd/

libpassim.so=1-64 ([passim](https://archlinux.org/packages/extra/x86_64/passim/))

[hughsie]

In fedora we have passim-libs with the library, and the main passim package with everything else.

[hughsie]

also, if you're using systemd you can just mask the passim service -- and fwupd will happily work without it.

[mohemiv]

https://gitlab.archlinux.org/archlinux/packaging/packages/fwupd/-/issues/2
https://bugs.archlinux.org/task/79614

Arch Linux fwupd's maintainers have decided that this is "won't fix", and everyone who uses fwupd should expose TCP/UDP ports by default.

@hughsie You are the only person who can influence something to change.

[hughsie]

the user who needs passim who should enable it

The millions of users who should be using passim don't even know what it's called. Please read https://blogs.gnome.org/hughsie/2023/07/28/introducing-passim/ for the why.

[mohemiv]

Millions of users who use Windows have SMB and 445/tcp, but don't even know what it's called. There are reasons why other users choose Linux, and one of those reasons is not to have SMB or in our case passim.

[hughsie]

one of those reasons is not to have SMB or in our case passim

I'm not going to argue with you any more. You have a choice to either recompile fwupd with -Dpassim=disabled, convince the Arch packagers to split out libpassim.so.* as a subpackage (and thus make the passim daemon removable) or you can mask the passim service in systemd.

[mohemiv]

Just to end the discussion, does Fedora's, Ubuntu's, Debian's, etc, fwupd build also opens TCP and UDP ports by default or not?

[hughsie]

Yes they do.