A shorewallrc file contains a number of lines of the form option=value. Because some of the installers are shared between Shorewall products, the files assume the definition of the symbol PRODUCT. $PRODUCT will contain the name of a Shorewall product (shorewall-core, shorewall, shorewall6, shorewall-lite, shorewall6-lite or shorewall-init).

Valid values for option are:

The configure script creates a file named shorewallrc in the current working directory. This file is the default input file to the install.sh scripts. It is run as follows:

The possible values for option are the same as those shone above in the shorewallrc file. They may be specified in either upper or lower case and may optionally be prefixed by '--'. To facilitate use with the rpm %configure script, the following options are supported:

Note that %configure may dsgenerate option/value pairs that are incompatible with the configure script. The current %configure macro is:

%configure \
  CFLAGS="${CFLAGS:-%optflags}" ; export CFLAGS ; \
  CXXFLAGS="${CXXFLAGS:-%optflags}" ; export CXXFLAGS ; \
  FFLAGS="${FFLAGS:-%optflags}" ; export FFLAGS ; \
  ./configure --host=%{_host} --build=%{_build} \\\
        --target=%{_target_platform} \\\
        --program-prefix=%{?_program_prefix} \\\
        --prefix=%{_prefix} \\\
        --exec-prefix=%{_exec_prefix} \\\
        --bindir=%{_bindir} \\\
        --sbindir=%{_sbindir} \\\
        --sysconfdir=%{_sysconfdir} \\\
        --datadir=%{_datadir} \\\
        --includedir=%{_includedir} \\\
        --libdir=%{_libdir} \\\
        --libexecdir=%{_libexecdir} \\\
        --localstatedir=%{_localstatedir} \\\
        --sharedstatedir=%{_sharedstatedir} \\\
        --mandir=%{_mandir} \\\
        --infodir=%{_infodir}

On Fedora 16, this expands to:

  CFLAGS="${CFLAGS:--O2 -g -march=i386 -mtune=i686}" ; export CFLAGS ; 
  CXXFLAGS="${CXXFLAGS:--O2 -g -march=i386 -mtune=i686}" ; export CXXFLAGS ; 
  FFLAGS="${FFLAGS:--O2 -g -march=i386 -mtune=i686}" ; export FFLAGS ; 
  ./configure --host=i686-pc-linux-gnu --build=i686-pc-linux-gnu \
        --program-prefix= \
        --prefix=/usr \
        --exec-prefix=/usr \
        --bindir=/usr/bin \
        --sbindir=/usr/sbin \
        --sysconfdir=/etc \
        --datadir=/usr/share \
        --includedir=/usr/include \
        --libdir=/usr/lib \
        --libexecdir=/usr/libexec \
        --localstatedir=/var \
        --sharedstatedir=/var/lib \
        --mandir=/usr/share/man \
        --infodir=/usr/share/info

The value of --host does not map to any of the valid HOST values in shorewallrc. So to use %configure on a Fedora system, you want to invoke it as follows:

%configure --vendor=redhat

To reset the value of a setting in shorewallrc.$host, give it a null value. For example, if you are installing on a RHEL derivative that doesn't run systemd, use this command:

./configure --vendor=redhat --systemd=

If you build your own packages, then you will want to install the Shorewall products into it's own directory tree. This is done by adding DESTDIR to the installer's environment. For example, to install a product for Debian into the /tmp/package directory:

DESTDIR=/tmp/package ./install.sh shorewallrc.debian

When DESTDIR is specified, the installers treat $DESTDIR as the root of the filesystem tree. In other words, the created installation is only runnable if one chroots to $DESTDIR. Please note that the uninstall.sh scripts cannot uninstall a configuration installed with non-empty DESTDIR.

When DESTDIR is used, the resulting configuration is not runnable, because all configuration pathnames are relative to $DESTDIR. Beginning with Shorewall 4.6.4, you can create runnable configurations separate from your main configuration. Here is a sample shorewallrc file:

                INSTALL_DIR=/usr/local/shorewall-custom
                HOST=suse
                PREFIX=${INSTALL_DIR}
                SHAREDIR=${INSTALL_DIR}/share
                LIBEXECDIR=${INSTALL_DIR}/lib
                PERLLIBDIR=${INSTALL_DIR}/lib/perl5
                CONFDIR=${INSTALL_DIR}/etc
                SBINDIR=${INSTALL_DIR}/usr/sbin
                MANDIR=${SHAREDIR}/man/
                INITDIR=${INSTALL_DIR}/etc/init.d
                INITSOURCE=init.suse.sh
                INITFILE=${PRODUCT}
                AUXINITSOURCE=
                AUXINITFILE=
                SYSTEMD=${INSTALL_DIR}/etc/systemd
                SERVICEFILE=${PRODUCT}.service
                SYSCONFFILE=sysconfig
                SYSCONFDIR=${INSTALL_DIR}/etc/sysconfig
                SPARSE=
                ANNOTATED=
                VARLIB=${INSTALL_DIR}/var/lib
                VARDIR=${VARLIB}/${PRODUCT}
                SANDBOX=Yes

The above shorewallrc creates a runnable configuration in /usr/local/shorewall-custom. It is triggered by adding SANDBOX to the shorewallrc file -- any non-empty value for that variable will prevent the installer from replacing the current main configuraiton.

Distributions have different philosophies about the proper file hierarchy. Two issures are particularly contentious:

To allow distributions to designate alternate locations for these files, the installers (install.sh) from 4.4.19 onward support the following environmental variables:

The default install locations are distribution dependent as shown in the following sections. These are the locations that are chosen by the install.sh scripts.