apiVersion: release-notes/v2
kind: bug-fix
area: installation
issue:
  - 42485

releaseNotes:
- |
  **Fixed** SELinux issue on CentOS9/RHEL9 where iptables-restore isn't allowed
  to open files in /tmp. Rules passed to iptables-restore are no longer written

	SUB	$16, RSP		// reserve 16 bytes for sp-8 where fp may be saved.
	BL	(R4)
	ADD	$16, RSP
	B	restore

nocgo:
	MOVD	$0x800000, R0                     // stacksize = 8192KB
	MOVD	$_rt0_arm64_linux_lib_go(SB), R1
	MOVD	R0, 8(RSP)
	MOVD	R1, 16(RSP)
	MOVD	$runtime·newosproc0(SB),R4
	BL	(R4)

restore:
	// Restore callee-save registers.
	RESTORE_R19_TO_R28(24)
	RESTORE_F8_TO_F15(104)
	RET

	SUB	$16, RSP	// reserve 16 bytes for sp-8 where fp may be saved.
	BL	(R4)
	ADD	$16, RSP
	B	restore

nocgo:
	MOVD	$0x800000, R0                     // stacksize = 8192KB
	MOVD	$_rt0_arm64_freebsd_lib_go(SB), R1
	MOVD	R0, 8(RSP)
	MOVD	R1, 16(RSP)
	MOVD	$runtime·newosproc0(SB),R4
	BL	(R4)

restore:
	// Restore callee-save registers.
	RESTORE_R19_TO_R28(24)
	RESTORE_F8_TO_F15(104)
	RET

- iptables
- iptables-save
- iptables-restore

But with the kernel legacy/nft split, there are parallel binaries for each of those, and again for ipv6 tables, so the actual potential binary set on any given linux machine can be some combination of:

- iptables-legacy
- iptables-nft
- ip6tables
- iptables-legacy-save
- iptables-nft-save
- iptables-legacy-restore
- iptables-nft-restore
- ip6tables-legacy

        renderer.addStandardOutputListener(listener)
        renderer.configure(LogLevel.INFO)
        def snapshot = renderer.snapshot()
        renderer.configure(LogLevel.DEBUG)

        when:
        renderer.restore(snapshot)
        renderer.onOutput(event('info', LogLevel.INFO))
        renderer.onOutput(event('debug', LogLevel.DEBUG))

        then:
        listener.value.readLines() == ['info']
    }

	JMP	finish

nosaveg:
	BL	(CTR)	// Call from VDSO

finish:
	MOVD	$0, R0		// Restore R0
	MOVD	0(R1), R3	// sec
	MOVD	8(R1), R5	// nsec
	MOVD	R15, R1		// Restore SP

	// Restore vdsoPC, vdsoSP
	// We don't worry about being signaled between the two stores.
	// If we are not in a signal handler, we'll restore vdsoSP to 0,
	// and no one will care about vdsoPC. If we are in a signal handler,

	MOVQ	0(SP), CX	// monotonic sec
	IMULQ	$1000000000, CX
	MOVQ	8(SP), DX	// monotonic nsec

	MOVQ	R12, SP		// Restore real SP

	// Restore vdsoPC, vdsoSP
	// We don't worry about being signaled between the two stores.
	// If we are not in a signal handler, we'll restore vdsoSP to 0,
	// and no one will care about vdsoPC. If we are in a signal handler,
	// we cannot receive another signal.
	MOVQ	8(SP), SI

	newObj := makeObj("pvc1", "5", "")

	// Restore object that doesn't exist
	cache.Restore("nothing")

	// Add old object to cache.
	informer.add(oldObj)
	verify(ktesting.WithStep(tCtx, "after initial update"), cache, oldObj.GetName(), oldObj, oldObj)

	// Restore object.
	cache.Restore(oldObj.GetName())
	verify(ktesting.WithStep(tCtx, "after initial Restore"), cache, oldObj.GetName(), oldObj, oldObj)

	_ = b[1]            // bounds check
	x := *p             // load a byte
	y := uint16(x)      // zero extend to 16 bits
	b[0] = byte(y >> 8) // compute ROLW
	b[1] = byte(y)
	nop()               // spill/restore ROLW
	b[0] = byte(y >> 8) // use ROLW
	b[1] = byte(y)
}

//go:noinline
func f32(p *uint8, b []byte) {
	_ = b[3]             // bounds check
	x := *p              // load a byte

	SUB	$16, RSP		// reserve 16 bytes for sp-8 where fp may be saved.
	BL	(R4)
	ADD	$16, RSP
	B	restore

nocgo:
	MOVD	$0x800000, R0                     // stacksize = 8192KB
	MOVD	$_rt0_arm64_netbsd_lib_go(SB), R1
	MOVD	R0, 8(RSP)
	MOVD	R1, 16(RSP)
	MOVD	$runtime·newosproc0(SB),R4
	BL	(R4)

restore:
	// Restore callee-save registers.
	RESTORE_R19_TO_R28(24)
	RESTORE_F8_TO_F15(104)
	RET