When working with Linux system services, encountering an "Access denied" error while trying to manage firewalld can be particularly frustrating. The error typically manifests in several ways:

# systemctl unmask firewalld
Failed to issue method call: Access denied

# sudo systemctl enable firewalld
Failed to issue method call: Access denied

Before diving into solutions, verify these fundamental aspects:

• Confirm firewalld package installation: rpm -q firewalld or dpkg -l firewalld
• Check your user's sudo privileges: sudo -l
• Verify SELinux status: getenforce

The access denial typically stems from:

1. Insufficient user privileges
2. SELinux policy restrictions
3. Corrupted systemd unit files
4. Missing or broken firewalld installation

1. Full Privilege Escalation

Try with root user directly:

su -
systemctl unmask firewalld
systemctl enable --now firewalld

2. Repairing Systemd Unit Files

Reinstall the service files:

# For RHEL/CentOS:
sudo yum reinstall firewalld

# For Debian/Ubuntu:
sudo apt-get install --reinstall firewalld

3. SELinux Context Repair

Check and restore proper contexts:

sudo restorecon -Rv /usr/lib/systemd/system/firewalld.service
sudo semanage fcontext -a -t systemd_unit_file_t "/usr/lib/systemd/system/firewalld.service"

4. Alternative Manual Unmask

Directly modify the symlink:

sudo rm /etc/systemd/system/firewalld.service
sudo ln -s /usr/lib/systemd/system/firewalld.service /etc/systemd/system/firewalld.service
sudo systemctl daemon-reload

After applying fixes:

systemctl is-enabled firewalld
systemctl status firewalld
firewall-cmd --state

• Maintain regular system updates
• Avoid manual modifications to systemd unit files
• Implement proper backup before service modifications
• Consider using configuration management tools like Ansible for service deployment

For persistent issues, examine system logs:

journalctl -u firewalld -b
ausearch -m avc -ts recent # For SELinux denials
systemctl show firewalld --property=FragmentPath

---

When checking firewalld status, you might encounter this state:

systemctl status firewalld
firewalld.service
   Loaded: masked (/dev/null)
   Active: inactive (dead)

The typical solution would be to unmask and enable the service, but these commands fail:

sudo systemctl unmask firewalld
# Failed to issue method call: Access denied

sudo systemctl enable firewalld
# Failed to issue method call: Access denied

This access denial typically occurs due to:

• SELinux policy restrictions
• Systemd unit file corruption
• Missing firewalld package or broken installation
• Permission issues with systemctl operations

First, verify the firewalld package installation:

rpm -q firewalld || dnf install firewalld -y

For SELinux-related issues, temporarily set to permissive mode:

sudo setenforce 0
sudo systemctl unmask firewalld
sudo systemctl enable --now firewalld
sudo setenforce 1 # Re-enable after fixing

If the unit file is missing, reinstall the package:

sudo dnf reinstall firewalld -y

Check for policy denials in audit logs:

sudo ausearch -m avc -ts recent | grep firewalld

Create custom SELinux policy if needed:

sudo grep firewalld /var/log/audit/audit.log | audit2allow -M mypolicy
sudo semodule -i mypolicy.pp

If standard commands fail, try direct symlink creation:

sudo ln -s /usr/lib/systemd/system/firewalld.service /etc/systemd/system/multi-user.target.wants/

Then reload systemd and restart:

sudo systemctl daemon-reload
sudo systemctl start firewalld

Verify successful operation:

sudo firewall-cmd --state
sudo systemctl is-enabled firewalld