I have a SELinux module that, among other things, allows Apache to connect via TCP to a specific port:

cat <<EOF > sgtest.te
module sgtest 1.0.0;

require {
   attribute port_type;
   type httpd_t;
   class tcp_socket name_socket;

type my_port_t, port_type;

allow httpd_t my_port_t:tcp_socket name_socket;

echo > sgtest.fc

checkmodule -M -m -o sgtest.mod sgtest.te
semodule_package -o sgtest.pp -m sgtest.mod -f sgtest.fc
semodule -i sgtest.pp

semanage port -a -t my_port_t -p tcp 2002

This installs okay and the rules appear to work.

The port is definitely installed:

$ semanage port -l | grep my_port_t
my_port_t                      tcp      2002

However, I can't remove the module:

$ semodule -r sgtest
libsemanage.semanage_direct_remove_key: Removing last sgtest module (no other sgtest module exists at another priority).
libsepol.context_from_record: type my_port_t is not defined (No such file or directory).
libsepol.context_from_record: could not create context structure (Invalid argument).
libsepol.port_from_record: could not create port structure for range 2002:2002 (tcp) (Invalid argument).
libsepol.sepol_port_modify: could not load port range 2002 - 2002 (tcp) (Invalid argument).
libsemanage.dbase_policydb_modify: could not modify record value (Invalid argument).
libsemanage.semanage_base_merge_components: could not merge local modifications into policy (Invalid argument).
semodule:  Failed!

This is on CentOS 7.4.1708.

What have I done wrong?


I don't understand how this works, or how it relates to the error message, but I've found that I can get out of the situation if I remove the port first:

semanage port -d -p tcp 2002
semodule -r sgtest

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.