Home / server / Questions / 448859
Accepted
Mike Purcell
Asked: 2012-11-15 17:56:29 +0800 CST

CentOS - semanage - Delete range of ports

  • 772

Surprisingly, could not find any clear information on how to delete a range of ports by way of semanage port. Here is a list of permutations I tried:

semanage port -d -t http_port_t -p tcp 0-60000
semanage port -d -t http_port_t -p tcp [1-60000]
semanage port -d -t http_port_t -p tcp 1,60000
semanage port -d -t http_port_t -p tcp 1-60000
semanage port -d -t http_port_t -p tcp 1 60000
semanage port -d -t http_port_t -p tcp 1,60000
semanage port -d -t http_port_t -p tcp <60000
semanage port -d -t http_port_t -p tcp '1-60000'
semanage port -d -t http_port_t -p tcp '1,60000'
semanage port -d -t http_port_t -p tcp 1000-10000

The help message wasn't clear on how to indicate a range:

root@service1 /etc/yum/pluginconf.d # -> semanage -h
/usr/sbin/semanage: 
semanage [ -S store ] -i [ input_file | - ]
semanage [ -S store ] -o [ output_file | - ]

semanage login -{a|d|m|l|D|E} [-nrs] login_name | %groupname
semanage user -{a|d|m|l|D|E} [-LnrRP] selinux_name
semanage port -{a|d|m|l|D|E} [-nrt] [ -p proto ] port | port_range
linux

1 Answers

  1. Best Answer

    Well that was impressive, you made me go to source code to find an answer. You did stumble across the proper way to define a range with your first try: two numbers must be separated by a hyphen.

    What's hanging you up is this:

    (rc, exists) = semanage_port_exists(self.sh, k)
if rc < 0:
    raise ValueError(_("Could not check if port %s/%s is defined") % (proto, port))
if not exists:
    raise ValueError(_("Port %s/%s is not defined") % (proto, port))

    If you specify a range of ports when adding a rule, you must specify the same range of ports when deleting a rule. For example:

    sudo semanage port -l | grep ^http_port_t
http_port_t                    tcp      80, 443, 488, 8008, 8009, 8443

    To delete those, you must call delete once for each port or port range between the commas. They can't be a contiguous range because they weren't defined that way.

    Conversely, with this example:

    mysqld_port_t                  tcp      1186, 3306, 63132-63163

    You can't individually delete 63132 or 63133. You must specify that exact range.

    Example of adding and deleting a range:

    semanage port --add -t http_port_t -p tcp 8899-8902
semanage port --delete -t http_port_t -p tcp 8899-8902
    • 9