Reference

Classes

Public Classes

selinux: Manage SELinux on RHEL based systems.

Private Classes

selinux::build: Configure the system for module building
selinux::config: Configure the system to use SELinux on the system.
selinux::package: Manages additional packages required to support some of the functions.
selinux::refpolicy_package: Manages additional packages required to support some of the functions.

Defined types

selinux::boolean: Manage the state of an SELinux boolean.
selinux::exec_restorecon: A convenience wrapper around a restorecon exec
selinux::fcontext: For fcontext equivalences, see selinux::fcontext::equivalence
selinux::fcontext::equivalence: Manage SELinux fcontext equivalences
selinux::module: Manage a SELinux module on a running system
selinux::permissive: Set SELinux type to permissive
selinux::port: Manage a SELinux local network port context setting

Resource types

selinux_fcontext: Manage SELinux fcontext definitions. You should use selinux::fcontext instead of this directly.
selinux_fcontext_equivalence: Manage SELinux fcontext equivalence definitions. You should use selinux::fcontext instead of this directly.
selinux_permissive: Manage SELinux permissive types.
selinux_port: Manage SELinux port definitions. You should use selinux::port instead of this directly.

Classes

selinux

Manage SELinux on RHEL based systems.

Examples

Enable enforcing mode with targeted policy

class { 'selinux':
  mode => 'enforcing',
  type => 'targeted',
}

Parameters

The following parameters are available in the selinux class.

`package_name`

Data type: Variant[String[1], Array[String[1]]]

sets the name(s) for the selinux tools package Default value: OS dependent (see data/).

`manage_auditd_package`

Data type: Boolean

install auditd to log SELinux violations, for OSes that do not have auditd installed by default. Default value: OS dependent (see data/)

`refpolicy_package_name`

Data type: String

sets the name for the refpolicy development package, required for the refpolicy module builder Default value: OS dependent (see data/)

`mode`

Data type: Optional[Enum['enforcing', 'permissive', 'disabled']]

sets the operating state for SELinux.

Default value: undef

`type`

Data type: Optional[Enum['targeted', 'minimum', 'mls']]

sets the selinux type

Default value: undef

`refpolicy_makefile`

Data type: Stdlib::Absolutepath

the path to the system's SELinux makefile for the refpolicy framework

Default value: '/usr/share/selinux/devel/Makefile'

`manage_package`

Data type: Boolean

manage the package for selinux tools and refpolicy

Default value: true

`auditd_package_name`

Data type: String[1]

used when manage_auditd_package is true

Default value: 'auditd'

`module_build_root`

Data type: Stdlib::Absolutepath

directory where modules are built. Defaults to $vardir/puppet-selinux

Default value: "${facts['puppet_vardir']}/puppet-selinux"

`default_builder`

Data type: Enum['refpolicy', 'simple']

which builder to use by default with selinux::module

Default value: 'simple'

`boolean`

Data type: Optional[Hash]

Hash of selinux::boolean resource parameters

Default value: undef

`fcontext`

Data type: Optional[Hash]

Hash of selinux::fcontext resource parameters

Default value: undef

`module`

Data type: Optional[Hash]

Hash of selinux::module resource parameters

Default value: undef

`permissive`

Data type: Optional[Hash]

Hash of selinux::module resource parameters

Default value: undef

`port`

Data type: Optional[Hash]

Hash of selinux::port resource parameters

Default value: undef

`exec_restorecon`

Data type: Optional[Hash]

Hash of selinux::exec_restorecon resource parameters

Default value: undef

Defined types

selinux::boolean

Manage the state of an SELinux boolean.

Examples

Enable `named_write_master_zones` boolean

selinux::boolean{ 'named_write_master_zones':
   ensure => 'on',
}

Ensure `named_write_master_zones` boolean is disabled

selinux::boolean{ 'named_write_master_zones':
   ensure => 'off',
}

Parameters

The following parameters are available in the selinux::boolean defined type.

`ensure`

Data type: Variant[Boolean, Enum['on', 'off', 'present', 'absent']]

Set to on or off

Default value: 'on'

`persistent`

Data type: Boolean

Set to false if you don't want it to survive a reboot.

Default value: true

selinux::exec_restorecon

Will execute after all other SELinux changes have been applied, but before Anchor['selinux::end']

Parameters

The following parameters are available in the selinux::exec_restorecon defined type.

`path`

Data type: Stdlib::Absolutepath

The path to run restorecon on. Defaults to resource title.

Default value: $title

`recurse`

Data type: Boolean

Whether restorecon should recurse. Defaults to true

Default value: true

`force`

Data type: Boolean

Whether restorecon should use force. Defaults to false.

Default value: false

`refreshonly`

Data type: Boolean

see the Exec resource

Default value: true

`unless`

Data type: Optional[String]

see the Exec resource

Default value: undef

`onlyif`

Data type: Optional[String]

see the Exec resource

Default value: undef

selinux::fcontext

For fcontext equivalences, see selinux::fcontext::equivalence

See also selinux::fcontext::equivalence

Examples

Add a file-context for mysql log files at non standard location

selinux::fcontext{'set-mysql-log-context':
  seltype  => 'mysqld_log_t',
  pathspec => '/u01/log/mysql(/.*)?',
}

Add a file-context only for directory types

selinux::fcontext{'/u/users/[^/]*':
  filetype => 'd',
  seltype  => 'user_home_dir_t' ,
}

Parameters

The following parameters are available in the selinux::fcontext defined type.

`ensure`

Data type: Enum['absent', 'present']

The desired state of the resource. Default: 'present'

Default value: 'present'

`seltype`

Data type: Optional[String]

String A particular SELinux type, like "mysqld_log_t"

Default value: undef

`seluser`

Data type: Optional[String]

String A particular SELinux user, like "sysadm_u"

Default value: undef

`pathspec`

Data type: String

String An semanage fcontext-formatted path specification, like "/var/log/mysql(/.*)?". Defaults to title

Default value: $title

`filetype`

Data type: Optional[String]

File type the context applies to (i.e. regular file, directory, block device, all files, etc.)

Types:
- a = all files (default value if not restricting filetype)
- f = regular file
- d = directory
- c = character device
- b = block device
- s = socket
- l = symbolic link
- p = named pipe

Default value: 'a'

selinux::fcontext::equivalence

Manage SELinux fcontext equivalences

Examples

Make /opt/wordpress equivalent to /usr/share/wordpress

selinux::fcontext::equivalence { '/opt/wordpress':
  ensure => 'present',
  target => '/usr/share/wordpress',
}

Parameters

The following parameters are available in the selinux::fcontext::equivalence defined type.

`path`

Data type: String

the path to define and equivalence for. Default: Resource title

Default value: $title

`target`

Data type: String

the path that this resource will be equivalent to.

`ensure`

Data type: Enum['present', 'absent']

the desired state of the equivalence. Default: present

Default value: 'present'

selinux::module

This class will either install or uninstall a SELinux module from a running system. This module allows an admin to keep .te files in text form in a repository, while allowing the system to compile and manage SELinux modules.

Concepts incorporated from: http://stuckinadoloop.wordpress.com/2011/06/15/puppet-managed-deployment-of-selinux-modules/

Examples

compile and load the apache module - does not require make or the policy

devel package
selinux::module{ 'apache':
  ensure    => 'present',
  source_te => 'puppet:///modules/selinux/apache.te',
  builder   => 'simple'
}

compile a module the refpolicy way. It will install the policy devel and

dependent packages like make.
selinux::module{ 'mymodule':
  ensure    => 'present',
  source_te => 'puppet:///modules/profile/selinux/mymodule.te',
  source_fc => 'puppet:///modules/profile/selinux/mymodule.fc',
  source_if => 'puppet:///modules/profile/selinux/mymodule.if',
  builder   => 'refpolicy'
}

compile and load a module from inline content

$content = @("END")
  policy_module(zabbix_fix, 0.1)
  require {
    type zabbix_t;
    type unreserved_port_t;
    class tcp_socket name_connect;
  }
  allow zabbix_t unreserved_port_t:tcp_socket name_connect;
  | END
selinux::module{ 'zabbix_fix':
  ensure     => 'present',
  content_te => $content,
  builder    => 'simple'
}

Parameters

The following parameters are available in the selinux::module defined type.

`ensure`

Data type: Enum['absent', 'present']

present or absent

Default value: 'present'

`source_pp`

Data type: Optional[String]

the source file (either a puppet URI or local file) of a pre-compiled SELinux policy package. Mutually excludsive with using source files.

Default value: undef

`source_te`

Data type: Optional[String]

the source file (either a puppet URI or local file) of the SELinux .te file

Default value: undef

`source_fc`

Data type: Optional[String]

the source file (either a puppet URI or local file) of the SELinux .fc file

Default value: undef

`source_if`

Data type: Optional[String]

the source file (either a puppet URI or local file) of the SELinux .if file

Default value: undef

`content_te`

Data type: Optional[String]

content of the SELinux .te file

Default value: undef

`content_fc`

Data type: Optional[String]

content of the SELinux .fc file

Default value: undef

`content_if`

Data type: Optional[String]

content of the SELinux .if file

Default value: undef

`builder`

Data type: Optional[Enum['simple', 'refpolicy']]

either 'simple' or 'refpolicy'. The simple builder attempts to use checkmodule to build the module, whereas 'refpolicy' uses the refpolicy framework, but requires 'make'

Default value: undef

selinux::permissive

Set SELinux type to permissive

Examples

Mark oddjob_mkhomedir_t permissive

selinux::permissive { 'oddjob_mkhomedir_t':
  ensure => 'present'
}

Parameters

The following parameters are available in the selinux::permissive defined type.

`ensure`

Data type: Enum['present', 'absent']

Set to present to add or absent to remove a permissive mode of a type

Default value: 'present'

`seltype`

Data type: String

A particular selinux type to make permissive, like "oddjob_mkhomedir_t"

Default value: $title

selinux::port

This method will manage a local network port context setting, and will persist it across reboots.

Examples

Add port-context syslogd_port_t to port 8514/tcp

selinux::port { 'allow-syslog-relp':
  ensure   => 'present',
  seltype  => 'syslogd_port_t',
  protocol => 'tcp',
  port     => 8514,
}

Parameters

The following parameters are available in the selinux::port defined type.

`ensure`

Data type: Enum['present', 'absent']

Set to present to add or absent to remove a port context.

Default value: 'present'

`seltype`

Data type: String

An SELinux port type

`protocol`

Data type: Enum['tcp', 'udp']

Either 'tcp', 'udp', 'ipv4' or 'ipv6'

`port`

Data type: Optional[Integer[1,65535]]

A network port number, like 8514,

Default value: undef

`port_range`

Data type: Optional[Tuple[Integer[1,65535], 2, 2]]

A port-range tuple, eg. [9090, 9095].

Default value: undef

Resource types

selinux_fcontext

Manage SELinux fcontext definitions. You should use selinux::fcontext instead of this directly.

Properties

The following properties are available in the selinux_fcontext type.

`ensure`

Valid values: present, absent

The basic property that the resource should be in.

Default value: present

`file_type`

Valid values: %r{^[abcdflps]$}

The file type to match

Default value: a

`seltype`

Valid values: %r{\w+}, <>

The SELinux type to apply to the paths

`seluser`

Valid values: %r{\w+}

The SELinux user name

`selrole`

Valid values: %r{\w+}

The SELinux role

`selrange`

Valid values: %r{\w+}

The SELinux range

Parameters

The following parameters are available in the selinux_fcontext type.

`title`

The namevar. Should be of the format pathspec_filetype

`pathspec`

Path regular expression

selinux_fcontext_equivalence

Manage SELinux fcontext equivalence definitions. You should use selinux::fcontext instead of this directly.

Properties

The following properties are available in the selinux_fcontext_equivalence type.

`ensure`

Valid values: present, absent

The basic property that the resource should be in.

Default value: present

`target`

The target of the equivalence. ie. the path that this resource will be equivalent to

Parameters

The following parameters are available in the selinux_fcontext_equivalence type.

`path`

The path to set equivalence for

selinux_permissive

Manage SELinux permissive types.

Properties

The following properties are available in the selinux_permissive type.

`ensure`

Valid values: present, absent

The basic property that the resource should be in.

Default value: present

Parameters

The following parameters are available in the selinux_permissive type.

`seltype`

namevar

The SELinux type that should be permissive

`local`

Valid values: true, false

A read-only attribue indicating whether the type is locally customized

selinux_port

Manage SELinux port definitions. You should use selinux::port instead of this directly.

Properties

The following properties are available in the selinux_port type.

`ensure`

Valid values: present, absent

The basic property that the resource should be in.

Default value: present

`low_port`

The low end of the port range to manage

`high_port`

The high end of the port range to manage

`protocol`

Valid values: tcp, udp

The protocol of the SELinux port definition

`seltype`

The SELinux type of the SELinux port definition

`source`

Valid values: policy, local

Source of the port configuration - either policy or local

Parameters

The following parameters are available in the selinux_port type.

`title`

Should be of the form "protocol_lowport-highport" or the type may misbehave

FilesExpand file tree

REFERENCE.md

Latest commit

History

REFERENCE.md

File metadata and controls

Reference

Table of Contents

Classes

selinux

Examples

Enable enforcing mode with targeted policy

Parameters

package_name

manage_auditd_package

refpolicy_package_name

mode

type

refpolicy_makefile

manage_package

auditd_package_name

module_build_root

default_builder

boolean

fcontext

module

permissive

port

exec_restorecon

Defined types

selinux::boolean

Examples

Enable named_write_master_zones boolean

Ensure named_write_master_zones boolean is disabled

Parameters

ensure

persistent

selinux::exec_restorecon

Parameters

path

recurse

force

refreshonly

unless

onlyif

selinux::fcontext

Examples

Add a file-context for mysql log files at non standard location

Add a file-context only for directory types

Parameters

ensure

seltype

seluser

pathspec

filetype

selinux::fcontext::equivalence

Examples

Make /opt/wordpress equivalent to /usr/share/wordpress

Parameters

path

target

ensure

selinux::module

Examples

compile and load the apache module - does not require make or the policy

compile a module the refpolicy way. It will install the policy devel and

compile and load a module from inline content

Parameters

ensure

source_pp

source_te

source_fc

source_if

content_te

content_fc

content_if

builder

selinux::permissive

Examples

Mark oddjob_mkhomedir_t permissive

`package_name`

`manage_auditd_package`

`refpolicy_package_name`

`mode`

`type`

`refpolicy_makefile`

`manage_package`

`auditd_package_name`

`module_build_root`

`default_builder`

`boolean`

`fcontext`

`module`

`permissive`

`port`

`exec_restorecon`

Enable `named_write_master_zones` boolean

Ensure `named_write_master_zones` boolean is disabled

`ensure`

`persistent`

`path`

`recurse`

`force`

`refreshonly`

`unless`

`onlyif`

`ensure`

`seltype`

`seluser`

`pathspec`

`filetype`

`path`

`target`

`ensure`

`ensure`

`source_pp`

`source_te`

`source_fc`

`source_if`

`content_te`

`content_fc`

`content_if`

`builder`

`ensure`

`seltype`

`ensure`

`seltype`

`protocol`

`port`

`port_range`

`ensure`

`file_type`

`seltype`

`seluser`

`selrole`

`selrange`

`title`

`pathspec`

`ensure`

`target`

`path`

`ensure`

`seltype`

`local`

`ensure`

`low_port`

`high_port`

`protocol`

`seltype`

`source`

`title`