Defined Type: selinux::fcontext

Defined in:
manifests/fcontext.pp

Overview

selinux::fcontext

This method will manage a local file context setting, and will persist it across reboots. It will perform a check to ensure the file context is not already set.

example Add a file-context only for directory types selinux::fcontext{'set-non-home-user-dir_type_d': filetype => true , filemode => 'd' , context => 'user_home_dir_t' , pathname => '/u/users/[^/]*' , }

Examples:

Add an path substition (equal) file-context

selinux::fcontext{'set-postfix-instance1-spool':
  equals      => true,
  pathname    => '/var/spool/postfix-instance1',
  destination => '/var/spool/postfix'
}

Add a file-context for mysql log files at non standard location

selinux::fcontext{'set-mysql-log-context':
  context => "mysqld_log_t",
  pathname => "/u01/log/mysql(/.*)?",
}

Parameters:

  • context (Any) (defaults to: undef)

    A particular file-context, like "mysqld_log_t"

  • pathname (Any)

    An semanage fcontext-formatted pathname, like "/var/log/mysql(/.*)?"

  • destination (Any) (defaults to: undef)

    The destination path used with the equals parameter.

  • equals (Any) (defaults to: false)

    Boolean Value - Enables support for substituting target path with sourcepath when generating default label

  • filetype (Any) (defaults to: false)

    Boolean Value - enables support for "-f" file type option of "semanage fcontext"

  • filemode (Any) (defaults to: 'a')

    File Mode for policy (i.e. regular file, directory, block device, all files, etc.)

    • Types:
      • a = all files (default value if not restricting filetype)
      • f = regular file
      • d = directory
      • c = character device
      • b = block device
      • s = socket
      • l = symbolic link
      • p = named pipe
  • restorecond (Any) (defaults to: true)

    Run restorecon against the path name upon changes (default true)

  • restorecond_path (Any) (defaults to: undef)

    Path name to use for restorecon (default $pathname)

  • restorecond_recurse (Any) (defaults to: false)

    Run restorecon recursive?



46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
# File 'manifests/fcontext.pp', line 46

define selinux::fcontext (
  $pathname,
  $destination         = undef,
  $context             = undef,
  $filetype            = false,
  $filemode            = 'a',
  $equals              = false,
  $restorecond         = true,
  $restorecond_path    = undef,
  $restorecond_recurse = false,
) {

  include ::selinux

  Anchor['selinux::module post'] ->
  Selinux::Fcontext[$title] ->
  Anchor['selinux::end']

  validate_absolute_path($pathname)
  validate_bool($filetype, $equals)

  if $equals {
    validate_absolute_path($destination)
  } else {
    validate_string($context)
  }

  $restorecond_path_private = $restorecond_path ? {
    undef   => $pathname,
    default => $restorecond_path
  }

  validate_absolute_path($restorecond_path_private)

  $restorecond_resurse_private = $restorecond_recurse ? {
    true  => ['-R'],
    false => [],
  }

  if $equals and $filetype {
    fail('Resource cannot contain both "equals" and "filetype" options')
  }

  if $equals {
    $resource_name = "add_${destination}_${pathname}"
    $command       = shellquote('semanage', 'fcontext','-a', '-e', $destination, $pathname)
    $unless        = sprintf('semanage fcontext -l | grep -Fx %s', shellquote("${pathname} = ${destination}"))
  } else {
    if $filemode !~ /^(?:a|f|d|c|b|s|l|p)$/ {
      fail('"filemode" must be one of: a,f,d,c,b,s,l,p - see "man semanage-fcontext"')
    }
    $resource_name = "add_${context}_${pathname}_type_${filemode}"
    if $::osfamily == 'RedHat' and $::operatingsystemmajrelease == '6' {
      case $filemode {
        'a': {
          $_filemode = 'all files'
          $_quotedfilemode = '\'all files\''
          }
        default: {
          $_filemode = $filemode
          $_quotedfilemode = $_filemode
        }
      }
    } else {
      $_filemode = $filemode
      $_quotedfilemode = $_filemode
    }
    $command       = shellquote('semanage', 'fcontext','-a', '-f', $_filemode, '-t', $context, $pathname)
    $unless        = sprintf('semanage fcontext -E | grep -Fx %s', shellquote("fcontext -a -f ${_quotedfilemode} -t ${context} '${pathname}'"))
  }

  Exec {
    path => '/bin:/sbin:/usr/bin:/usr/sbin',
  }

  exec { $resource_name:
    command => $command,
    unless  => $unless,
    require => Class['selinux::package'],
  }

  if $restorecond {
    exec { "restorecond ${resource_name}":
      command     => shellquote('restorecon', $restorecond_resurse_private, $restorecond_path_private),
      onlyif      => shellquote('test', '-e', $restorecond_path_private),
      refreshonly => true,
      subscribe   => Exec[$resource_name],
    }
  }

}