Bash Script fails to remove list of services from Firewalld

Question

I am attempting to clear out all existing services configured in firewalld via a bash script.

# produces {cockpit,dhcpv6-client,ssh} as an example
local EXISTING_SERVICES="{$(firewall-cmd --permanent --list-service | sed -e 's/ /,/g')}"
# firewall-cmd --permanent --remove-service={cockpit,dhcpv6-client,ssh}
firewall-cmd --permanent --remove-service="${EXISTING_SERVICES}"

When this is run, firewall-cmd returns:

Warning: NOT_ENABLED: {cockpit,dhcpv6-client,ssh}
success

The problem seems to be firewall-cmd interprets the list of services to disable as a single service name, instead of a list. When I run the command manually from the shell, the same exact (copy/pasted) command works like expected.

Example script to replicate:

EXISTING_SERVICES="{$(firewall-cmd --permanent --list-service | sed -e 's/ /,/g')}"
echo "firewall-cmd --permanent --remove-service=${EXISTING_SERVICES}"
firewall-cmd --permanent --remove-service="${EXISTING_SERVICES}"

Results:

What is the difference between running this via script and via direct shell commands?

---

Update: Tried running the script with set -x as suggested by @fra-san, which produced the following results when run from the script:

And the following results when run from the shell:

It seems the shell (and/or firewalld) behaves differently when run interactively and expands the list of services into 3 separate --remove-service= flags. This is very unexpected behavior.

Answer 1

firewall-cmd has nothing to do with that, and the difference is not between running your command in a script and running it interactively. Rather, you are executing two fundamentally different commands.

What you are seeing in action is brace expansion: the command

firewall-cmd --permanent --remove-service={cockpit,dhcpv6-client,ssh}

is expanded by Bash into

firewall-cmd --permanent --remove-service=cockpit --remove-service=dhcpv6-client --remove-service=ssh

This happens both in scripts and on the command line. Note, however, that the result of expansions is never parsed by the shell in search of further expansion-triggering characters. Hence, the command

firewall-cmd --permanent --remove-service="${EXISTING_SERVICES}"

in your script is expanded to

firewall-cmd --permanent --remove-service={cockpit,dhcpv6-client,ssh}

and run in that form (the expression in curly braces is taken literally at that point).

That seems not to be a valid firewall-cmd command. Quoting man firewall-cmd, the syntax for --remove-service is

... --remove-service=service

Remove a service. This option can be specified multiple times.

suggesting that the expected way of removing multiple services in a single run is

firewall-cmd ... --remove-service=foo --remove-service=bar ...

Using Bash, you may use an array to store the enabled services and build the corresponding list of options to remove them:

services=( $(firewall-cmd --permanent --list-services) )
firewall-cmd --permanent "${services[@]/#/--remove-service=}"

Where ${services[@]/#/--remove-service=} is Bash's pattern-substitution form of parameter expansion — # matches the empty string at the beginning of each array element and replaces it with --remove-service=.

While less efficient, in some situations it may however be more practical to add/remove one service at a time, because the exit status of firewall-cmd is set to 0 if at least one operation succeeds, regardless of how many operations fail. You may then prefer something as:

services=( $(firewall-cmd --permanent --list-services) )
for serv in "${services[@]}"
do
  firewall-cmd --permanent --remove-service="$serv" || echo "failed: $serv" >&2
done