Skip to content

Latest commit

 

History

History
907 lines (532 loc) · 19.9 KB

REFERENCE.md

File metadata and controls

907 lines (532 loc) · 19.9 KB
Raw

Reference

Table of Contents

Classes

Public Classes

  • selinux: Manage SELinux on RHEL based systems.

Private Classes

  • selinux::build: Configure the system for module building
  • selinux::config: Configure the system to use SELinux on the system.
  • selinux::package: Manages additional packages required to support some of the functions.
  • selinux::refpolicy_package: Manages additional packages required to support some of the functions.

Defined types

Resource types

  • selinux_fcontext: Manage SELinux fcontext definitions. You should use selinux::fcontext instead of this directly.
  • selinux_fcontext_equivalence: Manage SELinux fcontext equivalence definitions. You should use selinux::fcontext instead of this directly.
  • selinux_permissive: Manage SELinux permissive types.
  • selinux_port: Manage SELinux port definitions. You should use selinux::port instead of this directly.

Classes

selinux

Manage SELinux on RHEL based systems.

Examples

Enable enforcing mode with targeted policy
class { 'selinux':
  mode => 'enforcing',
  type => 'targeted',
}

Parameters

The following parameters are available in the selinux class:

package_name

Data type: Variant[String[1], Array[String[1]]]

sets the name(s) for the selinux tools package Default value: OS dependent (see data/).

manage_auditd_package

Data type: Boolean

install auditd to log SELinux violations, for OSes that do not have auditd installed by default. Default value: OS dependent (see data/)

refpolicy_package_name

Data type: String

sets the name for the refpolicy development package, required for the refpolicy module builder Default value: OS dependent (see data/)

mode

Data type: Optional[Enum['enforcing', 'permissive', 'disabled']]

sets the operating state for SELinux.

Default value: undef

type

Data type: Optional[Enum['targeted', 'minimum', 'mls']]

sets the selinux type

Default value: undef

refpolicy_makefile

Data type: Stdlib::Absolutepath

the path to the system's SELinux makefile for the refpolicy framework

Default value: '/usr/share/selinux/devel/Makefile'

manage_package

Data type: Boolean

manage the package for selinux tools and refpolicy

Default value: true

auditd_package_name

Data type: String[1]

used when manage_auditd_package is true

Default value: 'auditd'

manage_setroubleshoot_packages

Data type: Boolean

manage the setroubleshoot packages

setroubleshoot_package_names

Data type: Array[String]

the names of the setroubleshoot packages

Default value: []

module_build_root

Data type: Stdlib::Absolutepath

directory where modules are built. Defaults to $vardir/puppet-selinux

Default value: "${facts['puppet_vardir']}/puppet-selinux"

default_builder

Data type: Enum['refpolicy', 'simple']

which builder to use by default with selinux::module

Default value: 'simple'

boolean

Data type: Optional[Hash]

Hash of selinux::boolean resource parameters

Default value: undef

fcontext

Data type: Optional[Hash]

Hash of selinux::fcontext resource parameters

Default value: undef

module

Data type: Optional[Hash]

Hash of selinux::module resource parameters

Default value: undef

permissive

Data type: Optional[Hash]

Hash of selinux::module resource parameters

Default value: undef

port

Data type: Optional[Hash]

Hash of selinux::port resource parameters

Default value: undef

exec_restorecon

Data type: Optional[Hash]

Hash of selinux::exec_restorecon resource parameters

Default value: undef

Defined types

selinux::boolean

Manage the state of an SELinux boolean.

Examples

Enable named_write_master_zones boolean
selinux::boolean{ 'named_write_master_zones':
   ensure => 'on',
}
Ensure named_write_master_zones boolean is disabled
selinux::boolean{ 'named_write_master_zones':
   ensure => 'off',
}

Parameters

The following parameters are available in the selinux::boolean defined type:

ensure

Data type: Variant[Boolean, Enum['on', 'off', 'present', 'absent']]

Set to on or off

Default value: 'on'

persistent

Data type: Boolean

Set to false if you don't want it to survive a reboot.

Default value: true

selinux::exec_restorecon

Will execute after all other SELinux changes have been applied, but before Anchor['selinux::end']

Parameters

The following parameters are available in the selinux::exec_restorecon defined type:

path

Data type: Stdlib::Absolutepath

The path to run restorecon on. Defaults to resource title.

Default value: $title

recurse

Data type: Boolean

Whether restorecon should recurse. Defaults to true

Default value: true

force

Data type: Boolean

Whether restorecon should use force. Defaults to false.

Default value: false

refreshonly

Data type: Boolean

see the Exec resource

Default value: true

unless

Data type: Optional[String]

see the Exec resource

Default value: undef

onlyif

Data type: Optional[String]

see the Exec resource

Default value: undef

selinux::fcontext

For fcontext equivalences, see selinux::fcontext::equivalence

  • See also
    • selinux::fcontext::equivalence

Examples

Add a file-context for mysql log files at non standard location
selinux::fcontext{'set-mysql-log-context':
  seltype  => 'mysqld_log_t',
  pathspec => '/u01/log/mysql(/.*)?',
}
Add a file-context only for directory types
selinux::fcontext{'/u/users/[^/]*':
  filetype => 'd',
  seltype  => 'user_home_dir_t' ,
}

Parameters

The following parameters are available in the selinux::fcontext defined type:

ensure

Data type: Enum['absent', 'present']

The desired state of the resource. Default: 'present'

Default value: 'present'

seltype

Data type: Optional[String]

String A particular SELinux type, like "mysqld_log_t"

Default value: undef

seluser

Data type: Optional[String]

String A particular SELinux user, like "sysadm_u"

Default value: undef

pathspec

Data type: String

String An semanage fcontext-formatted path specification, like "/var/log/mysql(/.*)?". Defaults to title

Default value: $title

filetype

Data type: Optional[String]

File type the context applies to (i.e. regular file, directory, block device, all files, etc.)

  • Types:
    • a = all files (default value if not restricting filetype)
    • f = regular file
    • d = directory
    • c = character device
    • b = block device
    • s = socket
    • l = symbolic link
    • p = named pipe

Default value: 'a'

selinux::fcontext::equivalence

Manage SELinux fcontext equivalences

Examples

Make /opt/wordpress equivalent to /usr/share/wordpress
selinux::fcontext::equivalence { '/opt/wordpress':
  ensure => 'present',
  target => '/usr/share/wordpress',
}

Parameters

The following parameters are available in the selinux::fcontext::equivalence defined type:

path

Data type: String

the path to define and equivalence for. Default: Resource title

Default value: $title

target

Data type: String

the path that this resource will be equivalent to.

ensure

Data type: Enum['present', 'absent']

the desired state of the equivalence. Default: present

Default value: 'present'

selinux::module

This class will either install or uninstall a SELinux module from a running system. This module allows an admin to keep .te files in text form in a repository, while allowing the system to compile and manage SELinux modules.

Concepts incorporated from: http://stuckinadoloop.wordpress.com/2011/06/15/puppet-managed-deployment-of-selinux-modules/

Examples

compile and load the apache module - does not require make or the policy
devel package
selinux::module{ 'apache':
  ensure    => 'present',
  source_te => 'puppet:///modules/selinux/apache.te',
  builder   => 'simple'
}
compile a module the refpolicy way. It will install the policy devel and
dependent packages like make.
selinux::module{ 'mymodule':
  ensure    => 'present',
  source_te => 'puppet:///modules/profile/selinux/mymodule.te',
  source_fc => 'puppet:///modules/profile/selinux/mymodule.fc',
  source_if => 'puppet:///modules/profile/selinux/mymodule.if',
  builder   => 'refpolicy'
}
compile and load a module from inline content
$content = @("END")
  policy_module(zabbix_fix, 0.1)
  require {
    type zabbix_t;
    type unreserved_port_t;
    class tcp_socket name_connect;
  }
  allow zabbix_t unreserved_port_t:tcp_socket name_connect;
  | END
selinux::module{ 'zabbix_fix':
  ensure     => 'present',
  content_te => $content,
  builder    => 'simple'
}

Parameters

The following parameters are available in the selinux::module defined type:

ensure

Data type: Enum['absent', 'present']

present or absent

Default value: 'present'

source_pp

Data type: Optional[String]

the source file (either a puppet URI or local file) of a pre-compiled SELinux policy package. Mutually excludsive with using source files.

Default value: undef

source_te

Data type: Optional[String]

the source file (either a puppet URI or local file) of the SELinux .te file

Default value: undef

source_fc

Data type: Optional[String]

the source file (either a puppet URI or local file) of the SELinux .fc file

Default value: undef

source_if

Data type: Optional[String]

the source file (either a puppet URI or local file) of the SELinux .if file

Default value: undef

content_te

Data type: Optional[String]

content of the SELinux .te file

Default value: undef

content_fc

Data type: Optional[String]

content of the SELinux .fc file

Default value: undef

content_if

Data type: Optional[String]

content of the SELinux .if file

Default value: undef

builder

Data type: Optional[Enum['simple', 'refpolicy']]

either 'simple' or 'refpolicy'. The simple builder attempts to use checkmodule to build the module, whereas 'refpolicy' uses the refpolicy framework, but requires 'make'

Default value: undef

selinux::permissive

Set SELinux type to permissive

Examples

Mark oddjob_mkhomedir_t permissive
selinux::permissive { 'oddjob_mkhomedir_t':
  ensure => 'present'
}

Parameters

The following parameters are available in the selinux::permissive defined type:

ensure

Data type: Enum['present', 'absent']

Set to present to add or absent to remove a permissive mode of a type

Default value: 'present'

seltype

Data type: String

A particular selinux type to make permissive, like "oddjob_mkhomedir_t"

Default value: $title

selinux::port

This method will manage a local network port context setting, and will persist it across reboots.

Examples

Add port-context syslogd_port_t to port 8514/tcp
selinux::port { 'allow-syslog-relp':
  ensure   => 'present',
  seltype  => 'syslogd_port_t',
  protocol => 'tcp',
  port     => 8514,
}

Parameters

The following parameters are available in the selinux::port defined type:

ensure

Data type: Enum['present', 'absent']

Set to present to add or absent to remove a port context.

Default value: 'present'

seltype

Data type: String

An SELinux port type

protocol

Data type: Enum['tcp', 'udp']

Either 'tcp', 'udp', 'ipv4' or 'ipv6'

port

Data type: Optional[Integer[1,65535]]

A network port number, like 8514,

Default value: undef

port_range

Data type: Optional[Tuple[Integer[1,65535], 2, 2]]

A port-range tuple, eg. [9090, 9095].

Default value: undef

Resource types

selinux_fcontext

Manage SELinux fcontext definitions. You should use selinux::fcontext instead of this directly.

Properties

The following properties are available in the selinux_fcontext type.

ensure

Valid values: present, absent

The basic property that the resource should be in.

Default value: present

file_type

Valid values: %r{^[abcdflps]$}

The file type to match

Default value: a

selrange

Valid values: %r{\w+}

The SELinux range

selrole

Valid values: %r{\w+}

The SELinux role

seltype

Valid values: %r{\w+}, <<none>>

The SELinux type to apply to the paths

seluser

Valid values: %r{\w+}

The SELinux user name

Parameters

The following parameters are available in the selinux_fcontext type.

pathspec

Path regular expression

provider

The specific backend to use for this selinux_fcontext resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

title

The namevar. Should be of the format pathspec_filetype

selinux_fcontext_equivalence

Manage SELinux fcontext equivalence definitions. You should use selinux::fcontext instead of this directly.

Properties

The following properties are available in the selinux_fcontext_equivalence type.

ensure

Valid values: present, absent

The basic property that the resource should be in.

Default value: present

target

The target of the equivalence. ie. the path that this resource will be equivalent to

Parameters

The following parameters are available in the selinux_fcontext_equivalence type.

path

The path to set equivalence for

provider

The specific backend to use for this selinux_fcontext_equivalence resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

selinux_permissive

Manage SELinux permissive types.

Properties

The following properties are available in the selinux_permissive type.

ensure

Valid values: present, absent

The basic property that the resource should be in.

Default value: present

Parameters

The following parameters are available in the selinux_permissive type.

local

Valid values: true, false

A read-only attribue indicating whether the type is locally customized

provider

The specific backend to use for this selinux_permissive resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

seltype

namevar

The SELinux type that should be permissive

selinux_port

Manage SELinux port definitions. You should use selinux::port instead of this directly.

Properties

The following properties are available in the selinux_port type.

ensure

Valid values: present, absent

The basic property that the resource should be in.

Default value: present

high_port

The high end of the port range to manage

low_port

The low end of the port range to manage

protocol

Valid values: tcp, udp

The protocol of the SELinux port definition

seltype

The SELinux type of the SELinux port definition

source

Valid values: policy, local

Source of the port configuration - either policy or local

Parameters

The following parameters are available in the selinux_port type.

provider

The specific backend to use for this selinux_port resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

title

Should be of the form "protocol_lowport-highport" or the type may misbehave