Forge Home

Modules

Puppet

Resources

PuppetEcosystemPuppet CommunityUpdates

selinux

This class manages SELinux on RHEL based systems
Project URLRSS FeedReport issues

3,294,926 downloads

1,603 latest version

5.0 quality score

We run a couple of automated
scans to help you access a
module's quality. Each module is
given a score based on how well
the author has formatted their
code and documentation and
modules are also checked for
malware using VirusTotal.

Please note, the information below
is for guidance only and neither of
these methods should be considered
an endorsement by Puppet.

Version information

  • 5.0.0 (latest)
  • 4.1.0
  • 4.0.0
  • 3.4.1
  • 3.4.0
  • 3.3.1
  • 3.3.0
  • 3.2.0
  • 3.1.0
  • 3.0.0
  • 2.0.0
  • 1.6.1
  • 1.6.0
  • 1.5.3
  • 1.5.2
  • 1.5.1
  • 1.5.0
  • 1.4.0
  • 1.3.0
  • 1.2.0
  • 1.1.0
  • 1.0.0
  • 0.8.0
  • 0.7.1
  • 0.7.0
  • 0.6.0
  • 0.5.0
  • 0.4.1
released Nov 19th 2017
This version is compatible with:
  • Puppet Enterprise 2018.1.x, 2017.3.x, 2017.2.x, 2017.1.x, 2016.5.x, 2016.4.x
  • Puppet >= 4.7.1 < 6.0.0
  • ,

Start using this module

  • r10k or Code Manager
  • Bolt
  • Manual installation
  • Direct download

Add this module to your Puppetfile:

mod 'puppet-selinux', '1.4.0'
Learn more about managing modules with a Puppetfile

Add this module to your Bolt project:

bolt module add puppet-selinux
Learn more about using this module with an existing project

Manually install this module globally with Puppet module tool:

puppet module install puppet-selinux --version 1.4.0

Direct download is not typically how you would use a Puppet module to manage your infrastructure, but you may want to download the module in order to inspect the code.

Download

Documentation

puppet/selinux — version 1.4.0 Nov 19th 2017

SELinux module for Puppet

Build Status Code Coverage Puppet Forge Puppet Forge - downloads Puppet Forge - endorsement Puppet Forge - scores

Table of Contents

  1. Overview
  2. Module Description - What the module does and why it is useful
  3. Usage - Configuration options and additional functionality
  4. Reference - An under-the-hood peek at what the module is doing and how
  5. Defined Types
  6. Development - Guide for contributing to the module
  7. Authors

Overview

This class manages SELinux on RHEL based systems.

Requirements

  • Puppet 4 or later

Module Description

This module will configure SELinux and/or deploy SELinux based modules to running system.

Get in touch

Upgrading from puppet-selinux 0.8.x

  • Previously, module building always used the refpolicy framework. The default module builder is now 'simple', which uses only checkmodule. Not all features are supported with this builder.

    To build modules using the refpolicy framework like previous versions did, specify the 'refpolicy' builder either explicitly per module or globally via the main class

  • The interfaces to the various helper manifests has been changed to be more in line with Puppet file resource naming conventions.

    You will need to update your manifests to use the new parameter names.

  • The selinux::restorecond manifest to manage the restorecond service no longer exists

Known problems / limitations

  • If SELinux is disabled and you want to switch to permissive or enforcing you are required to reboot the system (limitation of SELinux). The module won't do this for you.
  • If SELinux is disabled and the user wants enforcing mode, the module will downgrade to permissive mode instead to avoid transitioning directly from disabled to enforcing state after a reboot and potentially breaking the system. The user will receive a warning when this happens,
  • If you add filecontexts with semanage fcontext (what selinux::fcontext does) the order is important. If you add /my/folder before /my/folder/subfolder only /my/folder will match (limitation of SELinux). There is no such limitation to file-contexts defined in SELinux modules. (GH-121)
  • While SELinux is disabled the defined types selinux::boolean, selinux::fcontext, selinux::port will produce puppet agent runtime errors because the used tools fail.
  • If you try to remove a built-in permissive type, the operation will appear to succeed but will actually have no effect, making your puppet runs non-idempotent.
  • The selinux_port provider may misbehave if the title does not correspond to the format it expects. Users should use the selinux::port define instead except when purging resources
  • Defining port ranges that overlap with existing ranges is currently not detected, and will cause semanage to error when the resource is applied.

Usage

Generated puppet strings documentation with examples is available from https://voxpupuli.org/puppet-selinux/

It's also included in the docs/ folder as simple html pages.

Reference

Basic usage

include selinux

This will include the module and allow you to use the provided defined types, but will not modify existing SELinux settings on the system.

More advanced usage

class { selinux:
  mode => 'enforcing',
  type => 'targeted',
}

This will include the module and manage the SELinux mode (possible values are enforcing, permissive, and disabled) and enforcement type (possible values are targeted, minimum, and mls). Note that disabling SELinux requires a reboot to fully take effect. It will run in permissive mode until then.

Deploy a custom module using the refpolicy framework

selinux::module { 'resnet-puppet':
  ensure    => 'present',
  source_te => 'puppet:///modules/site_puppet/site-puppet.te',
  source_fc => 'puppet:///modules/site_puppet/site-puppet.fc',
  source_if => 'puppet:///modules/site_puppet/site-puppet.if',
  builder   => 'refpolicy'
}

Set a boolean value

selinux::boolean { 'puppetagent_manage_all_files': }

Defined Types

  • boolean - Set seboolean values
  • fcontext - Define fcontext types and equals values
  • module - Manage an SELinux module
  • permissive - Set a context to permissive.
  • port - Set selinux port context policies

Development

Things to remember

  • The SELinux tools behave odd when SELinux is disabled
    • semanage requires --noreload while in disabled mode when adding or changing something
    • Only few --list operations work
  • run acceptance tests:
BEAKER_debug=yes BEAKER_set="centos-6-x64" PUPPET_INSTALL_TYPE="agent" bundle exec rake beaker &&
BEAKER_debug=yes BEAKER_set="centos-7-x64" PUPPET_INSTALL_TYPE="agent" bundle exec rake beaker &&
BEAKER_debug=yes BEAKER_set="fedora-25-x64" PUPPET_INSTALL_TYPE="agent" bundle exec rake beaker &&
BEAKER_debug=yes BEAKER_set="fedora-26-x64" PUPPET_INSTALL_TYPE="agent" bundle exec rake beaker &&
BEAKER_debug=yes BEAKER_set="fedora-27-x64" PUPPET_INSTALL_TYPE="agent" bundle exec rake beaker

Facter facts

The fact values might be unexpected while in disabled mode. One could expect the config_mode to be set, but only the boolean enabled is set.

The most important facts:

Fact Fact (old) Mode: disabled Mode: permissive Mode: enforcing
$facts['os']['selinux']['enabled'] $::selinux false true true
$facts['os']['selinux'['config_mode'] $::selinux_config_mode undef Value of SELINUX in /etc/selinux/config Value of SELINUX in /etc/selinux/config
$facts['os']['selinux']['current_mode'] $::selinux_current_mode undef Value of getenforce downcased Value of getenforce downcased

Authors