Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-5170

Semanage export does not distinguish between --modify and --add

    • policycoreutils-3.6-2.1.el9
    • None
    • Low
    • 1
    • rhel-sst-security-selinux
    • ssg_security
    • 26
    • 5
    • QE ack
    • False
    • Hide

      None

      Show
      None
    • No
    • CY24Q1
    • If docs needed, set a value
    • None

      Description of problem:
      Semanage export always uses a (add) even in cases where -m (-modify) needs to be used (modifying record specified in policy).
      Reproducible for "semange login" and "semanage fcontext" (and maybe others).

      Version-Release number of selected component (if applicable):
      policycoreutils-

      Steps to Reproduce:

      1. semanage login -m -s unconfined_u -r s0-s0:c0.c1023 _default_
      2. semanage export -f /tmp/exp
      3. semanage login -D
      4. semanage import -f /tmp/exp
        ValueError: Login mapping for _default_ is already defined

      Alternative reproducer:

      1. semanage fcontext -m -t boot_t "/xen(/.*)?"
      2. semanage export -f /tmp/exp
      3. semanage fcontext -D
      4. semanage import -f /tmp/exp
        ValueError: File context for /xen(/.*)? already defined

      Actual results:
      The login/fcontext mapping gets removed by semanage import.

      Expected results:
      The login/fcontext mapping is removed and re-add by semanage import (semanage login -D, semanage login -m -s unconfined_u -r s0-s0:c0.c1023 _default_).

              rhn-engineering-plautrba Petr Lautrbach
              vmojzis@redhat.com Vit Mojzis
              Petr Lautrbach Petr Lautrbach
              Amith Kumar Peethambaran Amith Kumar Peethambaran
              Votes:
              0 Vote for this issue
              Watchers:
              10 Start watching this issue

                Created:
                Updated:
                Resolved: