Bug 591135

Strange no data gets written and no error is thrown.

Looks like it is ignoring the protocol specifier (-p ipv6) and just always using ipv4/0.
Looking at the code, I see that:
seobject.py:nodeRecords:__add calls semanage_node_create() and semanage_node_set_addr(), but not semanage_node_set_proto().

Down in libsepol then, I see that:
sepol_node_create() defaults to SEPOL_PROTO_IP4.
sepol_node_set_addr() does not check or set the proto value even though it is supplied.

Options for fixing:
- Change seobject.py to call semanage_node_set_proto(proto), and change sepol_node_set_addr() to assert that node->proto == proto, -or-
- Change sepol_node_set_addr() to implicitly set node->proto to the specified value.

I don't think anyone has previously tried semanage node with ipv6.

Ok that fixes it so it can be added.  There seems to be a bug in semanage_node_query though.  It returns 1, None, when I try to modify the ::1 node.

Did you specify the mask and address precisely?

# semanage node -l
IP Address         Netmask            Protocol Context

0.0.0.0            0.0.0.0            ipv4  system_u:object_r:node_t:s0 
::1                ::1                ipv6  system_u:object_r:node_t:s0 


semanage node -m -t httpd_t -pipv6 -M ::1 ::1
Segmentation fault


      def __modify(self, addr, mask, proto, serange, setype):
               if addr == "":
                       raise ValueError(_("Node Address is required"))

               if mask == "":
                       raise ValueError(_("Node Netmask is required"))
               try:
                      proto = self.protocol.index(proto)
               except:
                      raise ValueError(_("Unknown or missing protocol"))

               if serange == "" and setype == "":
                       raise ValueError(_("Requires setype or serange"))

               (rc, k) = semanage_node_key_create(self.sh, addr, mask, proto)
               if rc < 0:
                       raise ValueError(_("Could not create key for %s") % addr)

               (rc, exists) = semanage_node_exists(self.sh, k)
               if rc < 0:
                       raise ValueError(_("Could not check if addr %s is defined") % addr)
               if not exists:
                       raise ValueError(_("Addr %s is not defined") % addr)

               (rc, node) = semanage_node_query(self.sh, k)
               if rc < 0:
                       raise ValueError(_("Could not query addr %s") % addr)

               con = semanage_node_get_con(node)
 BLOWS UP HERE because node==None

I can fix the problem by changing

               (rc, node) = semanage_node_query(self.sh, k)

To

               (rc, node) = semanage_node_query_local(self.sh, k)

Fixed in policycoreutils-2.0.82-21.el6

Red Hat Enterprise Linux 6.0 is now available and should resolve
the problem described in this bug report. This report is therefore being closed
with a resolution of CURRENTRELEASE. You may reopen this bug report if the
solution does not work for you.