firewall: actually copy firewall.user to image