On 09/21/2014 09:49 PM, Douglas Brown wrote:
Hi all,
SELinux has some configuration files such as /etc/selinux/config which are easily managed with a tool like puppet. There’s also modular policies that can be managed with rpms (via Satellite) and or puppet (semodule).
Finally puppet supports enforcing booleans with 'seboolean’. However, there’s a few things missing:
- SELinux user and role mappings
- Port labels (only supported in base policy or changed with semanage like so: semanage port -a -t httpd_port_t -p tcp 6312)
- Custom file labels (ie. semanage fcontext -a -t httpd_sys_content_t "/data/www(/.*)?")
I know these can be imported and exported with semanage using the -i and -o flags, however it’s slow and doesn't easily facilitate the programmatic query and enforcement of these settings at scale using a tool
like puppet. Ideally puppet could manage the .local files in /etc/selinux/targeted/modules/active/, however Red Hat support tells me this won’t work and that semanage is the only supported mechanism. Surely there’s someone in the community who has a non-hackish
method of dealing with this?
Is FreeIPA the solution to the user and role mappings? What about the labels?
Thanks,
Doug
--
selinux mailing list
selinux@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux
Why is managing this content via semanage not a good thing?
semanage is great for general administration but not for compliance; it's not really designed to compare an expected configuration with running configuration, and rectify any differences, rather, for the most part applies cumulative changes.
The openstack-selinux rpm package has a bunch of operations being done within a transaction, including setting network ports, booleans and default file labeling.
BTW Ansible is also a nice method for managing SELinux in the enterprise.
If we take the approach of importing all local customisations from a file with semanage, will it reapply each of the customisations in that file every time puppet runs it, or will it only apply the difference? (I.e. most of the time, there should not be
any difference so semanage won't recompile the running config)
How would we remove a config previously applied by semanage in this way?
Cheers,
Doug