With SeLinux it is possible to label ports per range: semanage port -a -t ldap_port_t -p tcp 1389-1391

If we want to create an instance (setup-ds.pl or setup-ds-admin.pl) with port 1390 for example, the script checks if the port has the 'ldap_port_t' label (using 'semanage port -l). But the port being covered by a range rather being present in the ports list, the script fails to detect that the port is correctly labelled. Then it relabel it, that takes a long time.

This could be fixed by something like:

diff /usr/lib64/dirsrv/perl/DSCreate.pm ./DSCreate.pm
1010,1013c1010,1023
< if ($inf->{slapd}->{ServerPort} == $labeledport) {
< $need_label = 0;
< last;
< }

    if (index($labeledport, "-") == -1) {
        # this is not a range
        if ($inf->{slapd}->{ServerPort} == $labeledport) {
            $need_label = 0;
            last;
        }
    } else {
        # this is a range
        my @range = split(/-/, $labeledport);
        if ((@range[0] <= $inf->{slapd}->{ServerPort}) && ($inf->{slapd}->{ServerPort} <= @range[1])) {
            $need_label = 0;
            last;
        }
    }