Defined Type: selinux::port
- Defined in:
- manifests/port.pp
Overview
selinux::fcontext
This method will manage a local network port context setting, and will persist it across reboots. It will perform a check to ensure the network context is not already set.
19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 |
# File 'manifests/port.pp', line 19
define selinux::port (
$context,
$port,
$protocol = undef,
$argument = '-a',
) {
include ::selinux
Anchor['selinux::module post'] ->
Selinux::Port[$title] ->
Anchor['selinux::end']
if $protocol {
validate_re($protocol, ['^tcp6?$', '^udp6?$'])
$protocol_switch = ['-p', $protocol]
$protocol_check = "${protocol} "
$port_exec_command = "add_${context}_${port}_${protocol}"
} else {
$protocol_switch = []
$protocol_check = '' # lint:ignore:empty_string_assignment variable is used to create regexp and undef is not possible
$port_exec_command = "add_${context}_${port}"
}
exec { $port_exec_command:
command => shellquote('semanage', 'port', $argument, '-t', $context, $protocol_switch, "${port}"), # lint:ignore:only_variable_string port can be number and we need to force it to be string for shellquote
# This works because there seems to be more than one space after protocol and before first port
unless => sprintf('semanage port -l | grep -E %s', shellquote("^${context} *${protocol_check}.* ${port}(\$|,)")),
path => '/bin:/sbin:/usr/bin:/usr/sbin',
require => Class['selinux::package'],
}
}
|