Hi,
semanage export always uses -a (--add) even in cases where -m (--modify)
is needed (when modifying record specified in policy).
Reproducible for "semange login" and "semanage fcontext" (and maybe others).
Steps to Reproduce:
# semanage login -m -s unconfined_u -r s0-s0:c0.c1023 __default__
# semanage export -f /tmp/exp
# semanage login -D
# semanage import -f /tmp/exp
ValueError: Login mapping for __default__ is already defined
# semanage login -lC
<empty>
# cat /tmp/exp
...
login -a -s unconfined_u -r 's0-s0:c0.c1023' __default__
^^^ should be "login -m" instead
Alternative reproducer:
# semanage fcontext -m -t boot_t "/xen(/.*)?"
# semanage export -f /tmp/exp
# semanage fcontext -D
# semanage import -f /tmp/exp
ValueError: File context for /xen(/.*)? already defined
# semanage fcontext -lC
<empty>
# cat /tmp/exp
...
fcontext -a -f a -t boot_t -r 's0' '/xen(/.*)?'
^^^ should be "fcontext -m" instead
Expected results:
The login/fcontext mapping is removed and re-add by semanage import
(semanage login -D, semanage login -m -s unconfined_u -r s0-s0:c0.c1023
__default__).
Is there a straightforward way of figuring out if the login mapping was
introduced by "semanage -m" while exporting customizations?
Alternatively I was thinking about modifying "semanage login --add" to
modify existing mapping if it exists, instead of exiting with an error.
But that is a change in behavior and may hide user mistakes.
