Version information
This version is compatible with:
- Puppet Enterprise 2018.1.x, 2017.3.x, 2017.2.x, 2017.1.x, 2016.5.x, 2016.4.x
- Puppet >= 4.7.0 < 6.0.0
- , , , , , , , , , ,
Start using this module
Add this module to your Puppetfile:
mod 'puppetlabs-selinux_core', '1.0.0'
Learn more about managing modules with a PuppetfileDocumentation
selinux_core
Table of Contents
- Description
- Setup - The basics of getting started with selinux_core
- Usage - Configuration options and additional functionality
- Reference - User documentation
- Limitations - OS compatibility, etc.
- Development - Guide for contributing to the module
Description
Manage SELinux context of files.
Setup
Setup Requirements
In order to use the selinux module, you must have selinux ruby bindings available on the system.
Beginning with selinux_core
To set the SELinux context on a file:
file { "/path/to/file":
selinux_ignore_defaults => false,
selrange => 's0',
selrole => 'object_r',
seltype => 'krb5_home_t',
seluser => 'user_u',
}
To manage a SELinux policy module:
selmodule { 'selmodule_policy':
ensure => present,
selmoduledir => '/usr/share/selinux/targeted',
}
To manage SELinux booleans:
selboolean { 'collectd_tcp_network_connect':
persistent => true,
value => on,
}
Usage
For details on usage, please see the puppet docs on selmodule, selboolean, and the selinux section of the file type
Reference
Please see REFERENCE.md for the reference documentation.
This module is documented using Puppet Strings.
For a quick primer on how Strings works, please see this blog post or the README.md for Puppet Strings.
To generate documentation locally, run
bundle install
bundle exec puppet strings generate ./lib/**/*.rb
This command will create a browsable \_index.html
file in the doc
directory. The references available here are all generated from YARD-style comments embedded in the code base. When any development happens on this module, the impacted documentation should also be updated.
Limitations
This module is only available on platforms that have selinux ruby bindings available.
Development
Puppet Labs modules on the Puppet Forge are open projects, and community contributions are essential for keeping them great. We can't access the huge number of platforms and myriad of hardware, software, and deployment configurations that Puppet is intended to serve.
We want to keep it as easy as possible to contribute changes so that our modules work in your environment. There are a few guidelines that we need contributors to follow so that we can have a chance of keeping on top of things.
For more information, see our module contribution guide.
Reference
Resource types
selboolean
: Manages SELinux booleans on systems with SELinux support. The supported booleans are any of the ones found in/selinux/booleans/
.selmodule
: Manages loading and unloading of SELinux policy modules on the system. Requires SELinux support. See man semodule(8) for more information o
Resource types
selboolean
Manages SELinux booleans on systems with SELinux support. The supported booleans
are any of the ones found in /selinux/booleans/
.
Properties
The following properties are available in the selboolean
type.
value
Valid values: on, off
Whether the SELinux boolean should be enabled or disabled.
Parameters
The following parameters are available in the selboolean
type.
name
namevar
The name of the SELinux boolean to be managed.
persistent
Valid values: true
, false
If set true, SELinux booleans will be written to disk and persist across reboots.
The default is false
.
Default value: false
selmodule
Manages loading and unloading of SELinux policy modules on the system. Requires SELinux support. See man semodule(8) for more information on SELinux policy modules.
Autorequires: If Puppet is managing the file containing this SELinux
policy module (which is either explicitly specified in the selmodulepath
attribute or will be found at {selmoduledir
}/{name
}.pp), the selmodule
resource will autorequire that file.
Properties
The following properties are available in the selmodule
type.
ensure
Valid values: present, absent
The basic property that the resource should be in.
Default value: present
syncversion
Valid values: true
, false
If set to true
, the policy will be reloaded if the
version found in the on-disk file differs from the loaded
version. If set to false
(the default) the only check
that will be made is if the policy is loaded at all or not.
Parameters
The following parameters are available in the selmodule
type.
name
namevar
The name of the SELinux policy to be managed. You should not include the customary trailing .pp extension.
selmoduledir
The directory to look for the compiled pp module file in.
Currently defaults to /usr/share/selinux/targeted
. If the
selmodulepath
attribute is not specified, Puppet will expect to find
the module in <selmoduledir>/<name>.pp
, where name
is the value of the
name
parameter.
Default value: /usr/share/selinux/targeted
selmodulepath
The full path to the compiled .pp policy module. You only need to use
this if the module file is not in the selmoduledir
directory.
Types in this module release
Changelog
All notable changes to this project will be documented in this file.
The format is based on Keep a Changelog and this project adheres to Semantic Versioning.
1.0.0 - 2018-06-07
Summary
This is the initial release of the extracted selinux module