Defined Type: selinux::port

Defined in:
manifests/port.pp

Overview

selinux::fcontext

This method will manage a local network port context setting, and will persist it across reboots. It will perform a check to ensure the network context is not already set.

Examples:

Add port-context syslogd_port_t to port 8514/tcp

selinux::port { 'allow-syslog-relp':
  context  => 'syslogd_port_t',
  protocol => 'tcp',
  port     => '8514',
}

Parameters:

  • context (Any)

    A port-context name

  • protocol (Any) (defaults to: undef)

    Either tcp or udp. If unset, omits -p flag from semanage.

  • port (Any)

    An network port number, like '8514'

  • argument (Any) (defaults to: '-a')

    An argument for semanage port. Default: "-a"



19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
# File 'manifests/port.pp', line 19

define selinux::port (
  $context,
  $port,
  $protocol = undef,
  $argument = '-a',
) {

  include ::selinux

  Anchor['selinux::module post'] ->
  Selinux::Port[$title] ->
  Anchor['selinux::end']

  if $protocol {
    validate_re($protocol, ['^tcp6?$', '^udp6?$'])
    $protocol_switch = ['-p', $protocol]
    $protocol_check = "${protocol} "
    $port_exec_command = "add_${context}_${port}_${protocol}"
  } else {
    $protocol_switch = []
    $protocol_check = '' # lint:ignore:empty_string_assignment variable is used to create regexp and undef is not possible
    $port_exec_command = "add_${context}_${port}"
  }

  exec { $port_exec_command:
    command => shellquote('semanage', 'port', $argument, '-t', $context, $protocol_switch, "${port}"), # lint:ignore:only_variable_string port can be number and we need to force it to be string for shellquote
    # This works because there seems to be more than one space after protocol and before first port
    unless  => sprintf('semanage port -l | grep -E %s', shellquote("^${context}  *${protocol_check}.* ${port}(\$|,)")),
    path    => '/bin:/sbin:/usr/bin:/usr/sbin',
    require => Class['selinux::package'],
  }
}