ToBeReplaced's questions

I have a breakfast package that Requires toast, bacon, and eggs. Importantly, breakfast needs exactly one eggs implementation to be a balanced meal.

The scrambled-eggs package Provides eggs. So does the fried-eggs package. In no circumstance should scrambled-eggs be installed alongside fried-eggs, even in the absence of breakfast.

If there were only two ways to prepare eggs, the solution would be to add Conflicts: fried-eggs to the scrambled-eggs package and vice versa. However, there are many ways to prepare eggs, some of which aren't even known yet, and a new way of preparing eggs might not be familiar with all of the other ways to prepare eggs.

Interestingly, it seems that for RPM version 4.11.3, you can make each package have both Provides: eggs and Conflicts: eggs, but this behavior does not seem to be documented. In fact, the documentation seems to suggest that it should not work:

Conflicts are basically inverse Requires. If there is a matching package the package cannot be installed. It does not matter whether the Conflict: tag is on the already installed or to be installed package.

Can I rely on the above Provides/Conflicts behavior for future versions of RPM? Or, how else can I solve this problem?

I have a server in a datacenter that serves as an IPA master and VPN server. For simplicity, assume I need to enable the "ipsec" service for VPN, and the "kerberos" service for IPA.

I would like to: 1) Allow traffic from anywhere to access the ipsec ports. 2) Only allow traffic from the private IP space to access the kerberos ports.

This seems easy enough; add a source IP space to the "work" zone, open up "kerberos" in the "work" zone, open up "ipsec" in the "public" zone. However, my interface "eth0" is only attached to the "public" zone. It seems like an interface is only meant to apply to a single zone.

So I have two questions. First, is what I would like to do reasonable? Second, what is the correct usage pattern to accomplish my goals with firewalld? As an example, I know I could accomplish my goals with rich rules, but this sounds like something that should be done using zones.

I need to allow Protocol 50 (esp) traffic for ipsec.

I can do:

iptables -A INPUT -p esp
iptables -A OUTPUT -p esp

How could I do this with firewalld instead?

Same question closed on StackOverflow because it was off-topic.