cookbook 'selinux_policy', '= 0.1.0'
selinux_policy
(42) Versions
0.1.0
-
Follow26
Manages SELinux policy components
cookbook 'selinux_policy', '= 0.1.0', :supermarket
knife supermarket install selinux_policy
knife supermarket download selinux_policy
SELinux Policy Cookbook
This cookbbok can be used to manage SELinux policies and components (rather than just enable / disable enforcing).
I made it because I needed some SELinux settings done, and the execute
s started to look annoying.
Requirements
Needs an SELinux policy active (so its values can be managed).
Also requires SELinux's management tools, namely semanage
, setsebool
and getsebool
.
Tools are installed by the selinux_policy::install
recipe (for RHEL/Debian and the like).
Attributes
None, at the moment.
Usage
This cookbook's functionality is exposed via resources, so it should be called from a wrapper cookbook.
Remember to add depends 'selinux_policy'
to your metadata.rb
.
boolean
Represents an SELinux boolean.
You can either set
it, meaning it will be changed without persistence (it will revert to default in the next reboot), or setpersist
it (default action), so it'll keep it value after rebooting.
Using setpersist
requires an active policy (so that the new value can be saved somewhere).
Attributes:
-
name
: boolean's name. Defaults to resource name. -
value
: Its new value (true
/false
). -
force
: Usesetsebool
even if the current value agrees with the requested one.
Example usage:
selinux_policy_boolean 'httpd_can_network_connect' do value true # Make sure nginx is started if this value was modified notifies :start,'service[nginx]', :immediate end
Note: Due to ruby interperting 0
as true
, using value 0
is unwise.
port
Allows assigning a network port to a certain SELinux context.
As explained here, it can be useful for running Apache on a non-standard port.
Actions:
-
addormodify
(default): Assigns the port to the right context, whether it's already listed another context or not at all. -
add
: Assigns the port to the right context it's if not listed (only uses-a
). -
modify
: Changes the port's context if it's already listed (only uses-m
). -
delete
: Removes the port's context if it's listed (uses-d
).
Attributes:
-
port
: The port in question, defaults to resource name. -
protocol
:tcp
/udp
. -
secontext
: The SELinux context to assign the port to. Uneeded when usingdelete
.
Example usage:
# Allow nginx to bind to port 5678, by giving it the http_port_t context selinux_policy_port '5678' do protocol 'tcp' secontext 'http_port_t' end
Contributing
The generic method seems fine to me:
- Fork the repository on Github
- Create a named feature branch (like
add_component_x
) - Write your change
- Write tests for your change (if applicable)
- Run the tests, ensuring they all pass
- Submit a Pull Request using Github
License and Authors
Licensed GPL v2
Author: Nitzan Raz (backslasher)
I'll be happy to accept contributions or to hear from you!
Dependent cookbooks
This cookbook has no specified dependencies.
Contingent cookbooks
selinuxpolicy CHANGELOG
This file is used to list changes made in each version of the selinuxpolicy cookbook.
0.1.0
- [backlasher] - Initial release of selinuxpolicy
Foodcritic Metric
0.1.0 failed this metric
FC017: LWRP does not notify when updated: /tmp/cook/084fbbeebe2cf261c6a290b1/selinux_policy/providers/boolean.rb:7
FC017: LWRP does not notify when updated: /tmp/cook/084fbbeebe2cf261c6a290b1/selinux_policy/providers/boolean.rb:12
FC017: LWRP does not notify when updated: /tmp/cook/084fbbeebe2cf261c6a290b1/selinux_policy/providers/port.rb:7
FC017: LWRP does not notify when updated: /tmp/cook/084fbbeebe2cf261c6a290b1/selinux_policy/providers/port.rb:15
FC017: LWRP does not notify when updated: /tmp/cook/084fbbeebe2cf261c6a290b1/selinux_policy/providers/port.rb:22
FC017: LWRP does not notify when updated: /tmp/cook/084fbbeebe2cf261c6a290b1/selinux_policy/providers/port.rb:28
0.1.0 failed this metric
FC017: LWRP does not notify when updated: /tmp/cook/084fbbeebe2cf261c6a290b1/selinux_policy/providers/boolean.rb:12
FC017: LWRP does not notify when updated: /tmp/cook/084fbbeebe2cf261c6a290b1/selinux_policy/providers/port.rb:7
FC017: LWRP does not notify when updated: /tmp/cook/084fbbeebe2cf261c6a290b1/selinux_policy/providers/port.rb:15
FC017: LWRP does not notify when updated: /tmp/cook/084fbbeebe2cf261c6a290b1/selinux_policy/providers/port.rb:22
FC017: LWRP does not notify when updated: /tmp/cook/084fbbeebe2cf261c6a290b1/selinux_policy/providers/port.rb:28