Bug 1439907

Summary: Setting booleans causes duplicate ports in semanage listings
Product: Red Hat Enterprise Linux 7 Reporter: Milos Malik <mmalik>
Component: libsemanageAssignee: Petr Lautrbach <plautrba>
Status: CLOSED ERRATA QA Contact: Milos Malik <mmalik>
Severity: medium Docs Contact:
Priority: medium    
Version: 7.4CC: cefrodrigues, dwalsh, lvrabec, mgrepl, mmalik, plautrba, ssekidde, vmojzis
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: libsemanage-2.5-8.el7 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: 1439875 Environment:
Last Closed: 2018-04-10 16:31:59 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Milos Malik 2017-04-06 19:46:50 UTC 
+++ This bug was initially created as a clone of Bug #1439875 +++

Description of problem:

I've noticed a strange interaction with custom ports and booleans. After setting a boolean, the list of ports for a particular type (which has been customized) shows duplicate entries.

Example:

  $ semanage port -a -t http_port_t -p tcp 12345
  $ semanage port -l | grep http_port_t
  http_port_t                    tcp      12345, 80, 81, ...
  $ setsebool -P zebra_write_config false
  $ semanage port -l | grep http_port_t
  http_port_t                    tcp      12345, 12345, 80, 81, ...
  $ setsebool -P zebra_write_config false
  $ semanage port -l | grep http_port_t
  http_port_t                    tcp      12345, 12345, 12345, 80, 81, ...

As can be seen, each time a boolean is set persistently (it doesn't matter which boolean or which state), the custom port 12345 is duplicated. Running "semodule -B" clears the duplicates.

However, if only the local customizations are listed, the port is always listed only once:

  $ semanage port -l -C
  SELinux Port Type              Proto    Port Number
  http_port_t                    tcp      12345

Version-Release number of selected component (if applicable):
libselinux-ruby-2.5-11.el7.x86_64
libselinux-devel-2.5-11.el7.x86_64
libselinux-2.5-11.el7.x86_64
libselinux-python-2.5-11.el7.x86_64
libselinux-utils-2.5-11.el7.x86_64

How reproducible:
Always

I've submitted this upstream here: https://github.com/SELinuxProject/selinux/issues/50
Comment 1 Petr Lautrbach 2017-04-11 08:04:44 UTC 
A fix for this issue is available at upstream mailing list - https://marc.info/?l=selinux&m=149183707331194&w=2
Comment 2 Lukas Vrabec 2017-08-17 08:05:40 UTC 
*** Bug 1336343 has been marked as a duplicate of this bug. ***
Comment 7 errata-xmlrpc 2018-04-10 16:31:59 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:0905