Bug 1008851 - setsebool cannot set known booleans if -P is used
Summary: setsebool cannot set known booleans if -P is used
Keywords:
Status: CLOSED DUPLICATE of bug 998974
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: policycoreutils
Version: 6.5
Hardware: Unspecified
OS: Linux
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Daniel Walsh
QA Contact: BaseOS QE Security Team
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-09-17 07:59 UTC by Sumit Bose
Modified: 2013-09-17 11:44 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-09-17 11:44:56 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Bugzilla 1007606 0 urgent CLOSED ipa-server-install failing with fault 907 during ipa-client-install phase 2021-02-22 00:41:40 UTC

Internal Links: 1007606

Description Sumit Bose 2013-09-17 07:59:59 UTC
Description of problem:
While testing IPA on 6.5 the IPA QE found found error messages like

2013-09-17T02:01:47Z DEBUG args=/usr/sbin/setsebool -P httpd_can_network_connect=on httpd_manage_ipa=on
2013-09-17T02:01:47Z DEBUG stdout=
2013-09-17T02:01:47Z DEBUG stderr=Boolean httpd_can_network_connect is not defined

and

2013-09-17T02:03:36Z DEBUG args=/usr/sbin/setsebool -P samba_portmapper=true
2013-09-17T02:03:36Z DEBUG stdout=
2013-09-17T02:03:36Z DEBUG stderr=Boolean samba_portmapper is not defined

in the log files of the IPA installation. After the installation the same could be seen on the command line:

]# /usr/sbin/setsebool -P samba_portmapper true
Boolean samba_portmapper is not defined
# semanage boolean -l | grep samba_portmapper
samba_portmapper               (aus  ,  aus)  Allow samba to act as a portmapper

After setting the boolean with semange everything is working as expected

# semanage boolean --on samba_portmapper
# getsebool samba_portmapper
samba_portmapper --> on
# setsebool samba_portmapper false
# getsebool samba_portmapper
samba_portmapper --> off
# setsebool -P samba_portmapper false
# /usr/sbin/setsebool -P samba_portmapper true
# getsebool samba_portmapper
samba_portmapper --> on

But only for the boolean touch by semanage others still fail if the -P option is used:

# /usr/sbin/setsebool -P httpd_manage_ipa true
Boolean httpd_manage_ipa is not defined
# /usr/sbin/setsebool  httpd_manage_ipa true
# /usr/sbin/setsebool -P httpd_manage_ipa true
Boolean httpd_manage_ipa is not defined
# /usr/sbin/getsebool httpd_manage_ipa
httpd_manage_ipa --> on
# /usr/sbin/setsebool -P httpd_manage_ipa true
Boolean httpd_manage_ipa is not defined



Version-Release number of selected component (if applicable):
policycoreutils-2.0.83-19.34.el6.x86_64


How reproducible:


Steps to Reproduce:
see above


Actual results:
setsebool -P cannot set a SELinux boolean

Expected results:
setsebool -P can set SELinux boolean

Additional info:
the same issue was observed by other team members while testing on RHEL7

Comment 2 Miroslav Grepl 2013-09-17 11:44:56 UTC

*** This bug has been marked as a duplicate of bug 998974 ***


Note You need to log in before you can comment on or make changes to this bug.