CentOS 7 Cannot delete ports defined for MongoDB

centos7mongodbportselinux

I installed and later removed the MongoDB server on a CentOS 7 box.

While cleaning up, I noticed that the ports assigned to MongoDB were still open. if I remember correctly, I was able to delete the main port (28017), but there are still two ranges defined:

$ sudo semanage port --list | grep mongo
mongod_port_t                  tcp      27017-27019, 28017-28019

When I try to remove the ranges, I get an error:

$ sudo semanage port -d -p tcp -t mongod_port_t 27017-27019
ValueError: Port tcp/27017-27019 is defined in policy, cannot be deleted
$ sudo semanage port -d -p tcp -t mongod_port_t 28017-28019
ValueError: Port tcp/28017-28019 is defined in policy, cannot be deleted

I have looked for any modules referring to MongoDB, but there does not seem to be anything there:

$ sudo semodule --list # => nothing mongo-related

Is there any way to find out in which policy the ports are defined? Or is there some other way to remove these ranges?

Thank you.

Best Answer

The SELinux policy included with RHEL includes definitions for ports (not to mention policies and booleans) from hundreds of services, not all of which are installed of course. There is no need to remove them.

Related Solutions

Best way to manage custom ports in SELinux

semanage creates new modules which are not under the control of the policy package. When the policy package is upgraded, these modules will remain and will be applied to the new policy when it is loaded.

Linux – CentOS – semanage – Delete range of ports

Well that was impressive, you made me go to source code to find an answer. You did stumble across the proper way to define a range with your first try: two numbers must be separated by a hyphen.

What's hanging you up is this:

(rc, exists) = semanage_port_exists(self.sh, k)
if rc < 0:
    raise ValueError(_("Could not check if port %s/%s is defined") % (proto, port))
if not exists:
    raise ValueError(_("Port %s/%s is not defined") % (proto, port))

If you specify a range of ports when adding a rule, you must specify the same range of ports when deleting a rule. For example:

sudo semanage port -l | grep ^http_port_t
http_port_t                    tcp      80, 443, 488, 8008, 8009, 8443

To delete those, you must call delete once for each port or port range between the commas. They can't be a contiguous range because they weren't defined that way.

Conversely, with this example:

mysqld_port_t                  tcp      1186, 3306, 63132-63163

You can't individually delete 63132 or 63133. You must specify that exact range.

Example of adding and deleting a range:

semanage port --add -t http_port_t -p tcp 8899-8902
semanage port --delete -t http_port_t -p tcp 8899-8902

Best Answer

Related Solutions

Best way to manage custom ports in SELinux

Linux – CentOS – semanage – Delete range of ports

Related Topic