Skip to content

Commit 937d5df

Browse files
magicalyakmagicalyak
committed
selinux enabled
1 parent c9f5903 commit 937d5df

File tree

4 files changed

+167
-3
lines changed

4 files changed

+167
-3
lines changed

‎defaults/main.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,3 +87,6 @@ log_policy_syslog_target: 127.0.0.1:514
8787

8888
nginx_demo_workload_protocol: http://
8989
nginx_demo_workload_host: 10.1.1.1:8080
90+
91+
# Enable enforcing selinux (you may need to open ports on your own)
92+
nginx_selinux: true

‎files/my-appprotect.te

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
2+
3+
#============= audisp_t ==============
4+
5+
#!!!! WARNING: 'unlabeled_t' is a base type.
6+
#!!!! The file '/etc/ld.so.cache' is mislabeled on your system.
7+
#!!!! Fix with $ restorecon -R -v /etc/ld.so.cache
8+
allow audisp_t unlabeled_t:file { execute execute_no_trans getattr open };
9+
10+
#============= httpd_t ==============
11+
allow httpd_t faillog_t:file { open read };
12+
13+
#!!!! This avc is allowed in the current policy
14+
allow httpd_t http_cache_port_t:tcp_socket name_connect;
15+
allow httpd_t httpd_config_t:file write;
16+
allow httpd_t httpd_initrc_exec_t:sock_file write;
17+
allow httpd_t httpd_log_t:file write;
18+
allow httpd_t httpd_sys_rw_content_t:fifo_file { getattr ioctl open read write };
19+
allow httpd_t httpd_var_run_t:fifo_file { getattr ioctl open read write };
20+
allow httpd_t httpd_var_run_t:file { execute execute_no_trans };
21+
22+
#!!!! The file '/opt/app_protect/pipe/app_protect_plugin_socket' is mislabeled on your system.
23+
#!!!! Fix with $ restorecon -R -v /opt/app_protect/pipe/app_protect_plugin_socket
24+
allow httpd_t initrc_t:unix_stream_socket connectto;
25+
allow httpd_t lastlog_t:file { open read write };
26+
27+
#!!!! This avc is allowed in the current policy
28+
allow httpd_t memcache_port_t:tcp_socket name_connect;
29+
allow httpd_t security_t:security compute_av;
30+
31+
#!!!! This avc is allowed in the current policy
32+
allow httpd_t self:capability audit_write;
33+
34+
#!!!! This avc is allowed in the current policy
35+
allow httpd_t self:netlink_audit_socket nlmsg_relay;
36+
allow httpd_t self:netlink_selinux_socket { bind create };
37+
allow httpd_t self:passwd passwd;
38+
allow httpd_t systemd_logind_t:dbus send_msg;
39+
40+
#!!!! This avc is allowed in the current policy
41+
allow httpd_t unreserved_port_t:tcp_socket { name_bind name_connect };
42+
allow httpd_t usr_t:dir { create rmdir };
43+
44+
#!!!! WARNING: 'usr_t' is a base type.
45+
allow httpd_t usr_t:file { create rename setattr unlink write };
46+
47+
#!!!! WARNING: 'usr_t' is a base type.
48+
allow httpd_t usr_t:sock_file write;
49+
allow httpd_t var_log_t:file { open read write };
50+
51+
#============= systemd_logind_t ==============
52+
allow systemd_logind_t httpd_t:dbus send_msg;

‎tasks/prerequisites/setup-centos.yml

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,10 @@
44
name: ca-certificates, epel-release
55
state: present
66

7-
# TODO: make this surgical rather than disabling SELinux globally
8-
- name: Disable SELinux
7+
- name: "(Install: CentOS) Disable SELinux"
98
selinux:
10-
state: disabled
9+
state: permissive
10+
11+
- name: "(Install: CentOS) Setup SELinux"
12+
import_tasks: setup-selinux.yml
13+
when: nginx_selinux

‎tasks/prerequisites/setup-selinux.yml

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
---
2+
- name: "(Install: SELinux) Install Required CentOS Dependencies"
3+
package:
4+
name: policycoreutils-python, setools
5+
state: present
6+
7+
- name: "(Install: SELinux: Booleans) Allow HTTP network connection"
8+
seboolean:
9+
name: httpd_can_network_connect
10+
state: yes
11+
persistent: yes
12+
13+
- name: "(Install: SELinux: Booleans) Allow HTTP relay connection"
14+
seboolean:
15+
name: httpd_can_network_relay
16+
state: yes
17+
persistent: yes
18+
19+
- name: "(Install: SELinux: Booleans) Allow HTTP mod auth pam"
20+
seboolean:
21+
name: httpd_mod_auth_pam
22+
state: yes
23+
persistent: yes
24+
25+
- name: "(Install: SELinux: Booleans) enable NIS"
26+
seboolean:
27+
name: nis_enabled
28+
state: yes
29+
persistent: yes
30+
31+
- name: "(Install: SELinux: Contexts) App Protect Logs"
32+
sefcontext:
33+
target: '/var/log/app_protect(/.*)?'
34+
setype: httpd_log_t
35+
state: present
36+
37+
- name: "(Install: SELinux: Contexts) App Protect Opt"
38+
sefcontext:
39+
target: '/opt/app_protect(/.*)?'
40+
setype: httpd_var_run_t
41+
state: present
42+
43+
- name: "(Install: SELinux: Contexts) App Protect Pipe"
44+
sefcontext:
45+
target: '/opt/app_protect/pipe(/.*)?'
46+
setype: httpd_initrc_exec_t
47+
state: present
48+
49+
- name: "(Install: SELinux: Contexts) App Protect Config"
50+
sefcontext:
51+
target: '/opt/app_protect/config(/.*)?'
52+
setype: httpd_config_t
53+
state: present
54+
55+
- name: "(Install: SELinux: Contexts) App Protect bin"
56+
sefcontext:
57+
target: '/opt/app_protect/bin(/.*)?'
58+
setype: httpd_exec_t
59+
state: present
60+
61+
- name: "(Install: SELinux: Contexts) App Protect lock"
62+
sefcontext:
63+
target: '/opt/app_protect/lock(/.*)?'
64+
setype: httpd_lock_t
65+
state: present
66+
67+
- name: "(Install: SELinux: Contexts) App Protect Temp"
68+
sefcontext:
69+
target: '/opt/app_protect/temp(/.*)?'
70+
setype: httpd_tmp_t
71+
state: present
72+
73+
- name: "(Install: SELinux: Contexts) App Protect Tmp"
74+
sefcontext:
75+
target: '/opt/app_protect/tmp(/.*)?'
76+
setype: httpd_tmp_t
77+
state: present
78+
79+
- name: "(Install: SELinux: Contexts) Apply contexts to opt"
80+
command: restorecon -iRv /opt/app_protect
81+
82+
- name: "(Install: SELinux: Contexts) Apply contexts to log"
83+
command: restorecon -iRv /var/log/app_protect
84+
85+
- name: "(Install: SELinux: Custom) Copy custom policy"
86+
copy:
87+
src: "{{ role_path }}/files/my-appprotect.te"
88+
dest: /tmp/my-appprotect.te
89+
90+
- name: "(Install: SELinux: Custom) Convert custom policy"
91+
command: checkmodule -M -m -o /tmp/my-appprotect.mod /tmp/my-appprotect.te
92+
93+
- name: "(Install: SELinux: Custom) Compile custom policy"
94+
command: semodule_package -o /tmp/my-appprotect.pp -m /tmp/my-appprotect.mod
95+
96+
- name: "(Install: SELinux: Custom) Apply custom policy"
97+
command: semanage -i /tmp/my-appprotect.pp
98+
99+
- name: "(Install: SELinux: Custom) Remove temporary files"
100+
file:
101+
path: /tmp/my-appprotect.*
102+
state: absent
103+
104+
- name: "(Install: SELinux) Enforce SELinux"
105+
selinux:
106+
state: enforcing

0 commit comments

Comments
 (0)