Bug 974158

This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated
in the current release, Red Hat is unable to address this
request at this time.

Red Hat invites you to ask your support representative to
propose this request, if appropriate, in the next release of
Red Hat Enterprise Linux.

Well in actuality the label is the second label, the tooling is showing it incorrectly, I believe as far as the kernel is concerned the second label wins.

First matching entry in the port contexts list wins as far as the kernel is concerned.  But I think semanage and friends are not representing it that way and thus the presented order (a hash walk?) may be arbitrary and unrelated to what is used.  It should just prevent redundant definitions from being added (removing/replacing the old if necessary)

(In reply to Dalibor Pospíšil from comment #0)
> Description of problem:
> semanage allow to modify default port type while keeps the assignment to the
> old type. This leads to situation where one port has two types. Also
> semanage -o - generates wrong outut which cannot be applied. Moreover after
> modifying the the port and modyfying it back to the original type I can
> delete the type for the first time. The second time I get '... is defined in
> policy, cannot be deleted' message.
> 
> Version-Release number of selected component (if applicable):
> policycoreutils-python-2.0.83-19.30.el6
> 
> How reproducible:
> 100%
> 
> Steps to Reproduce:
> [root@rhel6 ~]# semanage port -m -t http_port_t -p tcp 8080
> [root@rhel6 ~]# semanage port -l | grep 8080
> http_cache_port_t              tcp      3128, 8080, 8118, 8123, 10001-10010
> http_port_t                    tcp      8080, 80, 443, 488, 8008, 8009, 8443
> [root@rhel6 ~]# semanage -o - | grep 8080
> port -a -t http_port_t -p tcp 8080
> [root@rhel6 ~]# semanage port -m -t http_cache_port_t -p tcp 8080
> [root@rhel6 ~]# semanage port -l | grep 8080
> http_cache_port_t              tcp      8080, 3128, 8080, 8118, 8123,
> 10001-10010
> [root@rhel6 ~]# semanage -o - | grep 8080
> port -a -t http_cache_port_t -p tcp 8080
> [root@rhel6 ~]# semanage port -d -t http_cache_port_t -p tcp 8080
> [root@rhel6 ~]# semanage port -d -t http_cache_port_t -p tcp 8080
> /usr/sbin/semanage: Port tcp/8080 is defined in policy, cannot be deleted
> 
> I would expect that semanage is able to remove default rule as local
> customization and then add new rule. So the 'semanage port -m' would be
> internally translated into 'semanage port -d' and 'semanage port -a'
> sequence.

We don't want to remove the default port declaration. The local modification is used if you define it.

So it looks it is a bug in "semanage-port -l".

I believe we can close it as WONTFIX in RHEL6 per Comment #5.