salt.states.selinux

Management of SELinux rules

If SELinux is available for the running system, the mode can be managed and booleans can be set.

enforcing:
    selinux.mode

samba_create_home_dirs:
    selinux.boolean:
      - value: True
      - persist: True

nginx:
    selinux.module:
      - enabled: False

Note

Use of these states require that the selinux execution module is available.

salt.states.selinux.boolean(name, value, persist=False)

Set up an SELinux boolean

name
The name of the boolean to set
value
The value to set on the boolean
persist
Defaults to False, set persist to true to make the boolean apply on a reboot
salt.states.selinux.fcontext_policy_absent(name, filetype='a', sel_type=None, sel_user=None, sel_level=None)

New in version 2017.7.0.

Makes sure an SELinux file context policy for a given filespec (name), filetype and SELinux context type is absent.

name
filespec of the file or directory. Regex syntax is allowed.
filetype
The SELinux filetype specification. Use one of [a, f, d, c, b, s, l, p]. See also man semanage-fcontext. Defaults to 'a' (all files).
sel_type
The SELinux context type. There are many.
sel_user
The SELinux user.
sel_level
The SELinux MLS range.
salt.states.selinux.fcontext_policy_applied(name, recursive=False)

New in version 2017.7.0.

Checks and makes sure the SELinux policies for a given filespec are applied.

salt.states.selinux.fcontext_policy_present(name, sel_type, filetype='a', sel_user=None, sel_level=None)

New in version 2017.7.0.

Makes sure a SELinux policy for a given filespec (name), filetype and SELinux context type is present.

name
filespec of the file or directory. Regex syntax is allowed.
sel_type
SELinux context type. There are many.
filetype
The SELinux filetype specification. Use one of [a, f, d, c, b, s, l, p]. See also man semanage-fcontext. Defaults to 'a' (all files).
sel_user
The SELinux user.
sel_level
The SELinux MLS range.
salt.states.selinux.mode(name)

Verifies the mode SELinux is running in, can be set to enforcing, permissive, or disabled

Note: A change to or from disabled mode requires a system reboot.
You will need to perform this yourself.
name
The mode to run SELinux in, permissive, enforcing, or disabled.
salt.states.selinux.module(name, module_state='Enabled', version='any', **opts)

Enable/Disable and optionally force a specific version for an SELinux module

name
The name of the module to control
module_state
Should the module be enabled or disabled?
version
Defaults to no preference, set to a specified value if required. Currently can only alert if the version is incorrect.
install
Setting to True installs module
source
Points to module source file, used only when install is True
remove
Setting to True removes module

New in version 2016.3.0.

salt.states.selinux.module_install(name)

Installs custom SELinux module from given file

name
Path to file with module to install

New in version 2016.11.6.

salt.states.selinux.module_remove(name)

Removes SELinux module

name
The name of the module to remove

New in version 2016.11.6.