Bug 856550 - record not found in the database: setsebool -P old_boolean_name ...
record not found in the database: setsebool -P old_boolean_name ...
Status: CLOSED CURRENTRELEASE
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: policycoreutils (Show other bugs)
7.0
All Linux
high Severity high
: rc
: ---
Assigned To: Daniel Walsh
Milos Malik
:
Depends On:
Blocks: 913612
  Show dependency treegraph
 
Reported: 2012-09-12 05:51 EDT by Milos Malik
Modified: 2014-06-17 22:38 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2014-06-13 08:30:33 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Milos Malik 2012-09-12 05:51:16 EDT
Description of problem:
inspired by https://fedoraproject.org/wiki/Features/SELinuxBooleansRename

Version-Release number of selected component (if applicable):
policycoreutils-sandbox-2.1.12-5.el7.x86_64
policycoreutils-python-2.1.12-5.el7.x86_64
policycoreutils-newrole-2.1.12-5.el7.x86_64
policycoreutils-2.1.12-5.el7.x86_64

How reproducible:
always

Steps to Reproduce:
# getsebool allow_ypbind
nis_enabled --> on
# setsebool allow_ypbind off
# setsebool -P allow_ypbind on
libsemanage.dbase_llist_set: record not found in the database
libsemanage.dbase_llist_set: could not set record value
Could not change boolean allow_ypbind
Could not change policy booleans
# echo $?
255
#

Actual results:
 * boolean value cannot be set permanently when old name is used

Expected results:
 * boolean value can be set permanently when old name is used
Comment 1 Miroslav Grepl 2012-09-12 07:46:29 EDT
The problem is we renamed boolean.

setsebool -P nis_enabled on

should work.
Comment 2 Milos Malik 2012-09-12 08:29:13 EDT
I know it will work.

Excerpt from https://fedoraproject.org/wiki/Features/SELinuxBooleansRename:

This fix will rename the booleans to something that makes better sense, but will continue to support the old booleans so scripts, documentation and web searches that return the old names will continue to work. Also if you are using an older system and wanted to set allow_polyinstantion on all platforms you will be able to set it on the new system, even thought the boolean name has been renamed to polyinstantion_enabled.
Comment 3 Daniel Walsh 2012-09-18 10:29:37 EDT
Yes we have fixed this in F18, I will begin updating RHEL with the new packages.
Comment 4 Daniel Walsh 2012-09-18 10:45:12 EDT
Fixed in libselinux-2.1.12-1.el7 and libsemanage-2.1.9-1.el7
Comment 5 Milos Malik 2012-10-19 08:23:53 EDT
# semanage boolean -l -F > all-booleans.txt
# cat all-booleans.txt | wc -l
230
# semanage boolean -m -F all-booleans.txt 
# echo $?
0
# sed -i 's/nis_enabled/allow_ypbind/' all-booleans.txt 
# cat all-booleans.txt | wc -l
230
# semanage boolean -m -F all-booleans.txt 
/usr/sbin/semanage: Boolean allow_ypbind is not defined
# echo $?
1
#
Comment 6 Milos Malik 2012-10-19 08:25:24 EDT
Sorry, I forgot to mention NVRs:

# rpm -qa | grep -e libselinux -e libsemanage | sort
libselinux-2.1.12-5.el7.x86_64
libselinux-devel-2.1.12-5.el7.x86_64
libselinux-python-2.1.12-5.el7.x86_64
libselinux-ruby-2.1.12-5.el7.x86_64
libselinux-utils-2.1.12-5.el7.x86_64
libsemanage-2.1.9-1.el7.x86_64
libsemanage-python-2.1.9-1.el7.x86_64
#
Comment 7 Daniel Walsh 2012-10-25 14:23:52 EDT
Fixed in policycoreutils-2.1.13-17.el7
Comment 11 Ludek Smid 2014-06-13 08:30:33 EDT
This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.

Note You need to log in before you can comment on or make changes to this bug.