SELinux module for Puppet

Table of Contents

1. Overview
2. Module Description - What the module does and why it is useful
3. Usage - Configuration options and additional functionality
4. Reference - An under-the-hood peek at what the module is doing and how
5. Defined Types
6. Development - Guide for contributing to the module
7. Authors

Overview

This class manages SELinux.

Requirements

• See metadata.json

Module Description

This module will configure SELinux and/or deploy SELinux based modules to running system.

Get in touch

• IRC: #voxpupuli on irc.freenode.net (Freenode WebChat)
• Mailinglist: voxpupuli@groups.io (groups.io Webinterface)

Upgrading from puppet-selinux 0.8.x

• Previously, module building always used the refpolicy framework. The default module builder is now 'simple', which uses only checkmodule. Not all features are supported with this builder.

  To build modules using the refpolicy framework like previous versions did, specify the 'refpolicy' builder either explicitly per module or globally via the main class

• The interfaces to the various helper manifests has been changed to be more in line with Puppet file resource naming conventions.

  You will need to update your manifests to use the new parameter names.

• The selinux::restorecond manifest to manage the restorecond service no longer exists

Known problems / limitations

• The selinux_python_command fact is now deprecated and will be removed in version 4 of the module.
• If SELinux is disabled and you want to switch to permissive or enforcing you are required to reboot the system (limitation of SELinux). The module won't do this for you.
• If SELinux is disabled and the user wants enforcing mode, the module will downgrade to permissive mode instead to avoid transitioning directly from disabled to enforcing state after a reboot and potentially breaking the system. The user will receive a warning when this happens,
• If you add filecontexts with semanage fcontext (what selinux::fcontext does) the order is important. If you add /my/folder before /my/folder/subfolder only /my/folder will match (limitation of SELinux). There is no such limitation to file-contexts defined in SELinux modules. (GH-121)
• If you try to remove a built-in permissive type, the operation will appear to succeed but will actually have no effect, making your puppet runs non-idempotent.
• The selinux_port provider may misbehave if the title does not correspond to the format it expects. Users should use the selinux::port define instead except when purging resources
• Defining port ranges that overlap with existing ranges is currently not detected, and will cause semanage to error when the resource is applied.
• On Debian systems, the defined types fcontext, permissive, and port do not work because of PA-2985.

Usage

Generated puppet strings documentation with examples is available in the REFERENCE.md

It's also included in the docs/ folder as simple html pages.

Reference

Basic usage

include selinux

This will include the module and allow you to use the provided defined types, but will not modify existing SELinux settings on the system.

More advanced usage

class { selinux:
  mode => 'enforcing',
  type => 'targeted',
}

This will include the module and manage the SELinux mode (possible values are enforcing, permissive, and disabled) and enforcement type (possible values are targeted, minimum, and mls). Note that disabling SELinux requires a reboot to fully take effect. It will run in permissive mode until then.

Deploy a custom module using the refpolicy framework

selinux::module { 'resnet-puppet':
  ensure    => 'present',
  source_te => 'puppet:///modules/site_puppet/site-puppet.te',
  source_fc => 'puppet:///modules/site_puppet/site-puppet.fc',
  source_if => 'puppet:///modules/site_puppet/site-puppet.if',
  builder   => 'refpolicy'
}

Using pre-compiled policy packages

selinux::module { 'resnet-puppet':
  ensure    => 'present',
  source_pp => 'puppet:///modules/site_puppet/site-puppet.pp',
}

Note that pre-compiled policy packages may not work reliably across all RHEL / CentOS releases. It's up to you as the user to test that your packages load properly.

Set a boolean value

selinux::boolean { 'puppetagent_manage_all_files': }

Defined Types

• boolean - Set seboolean values
• fcontext - Define fcontext types and equals values
• module - Manage an SELinux module
• permissive - Set a context to permissive.
• port - Set selinux port context policies

Development

Things to remember

• The SELinux tools behave odd when SELinux is disabled
  • semanage requires --noreload while in disabled mode when adding or changing something
  • Only few --list operations work
• run acceptance tests: ./test-acceptance-with-vagrant

Facter facts

The fact values might be unexpected while in disabled mode. One could expect the config_mode to be set, but only the boolean enabled is set.

The most important facts:

Fact	Fact (old)	Mode: disabled	Mode: permissive	Mode: enforcing
$facts['os']['selinux']['enabled']	$::selinux	false	true	true
$facts['os']['selinux']['config_mode']	$::selinux_config_mode	undef	Value of SELINUX in /etc/selinux/config	Value of SELINUX in /etc/selinux/config
$facts['os']['selinux']['current_mode']	$::selinux_current_mode	undef	Value of getenforce downcased	Value of getenforce downcased

Authors

• VoxPupuli voxpupuli@groups.io
• James Fryman james@fryman.io

Reference

Table of Contents

Classes

Public Classes

• selinux: Manage SELinux on RHEL based systems.

Private Classes

• selinux::build: Configure the system for module building
• selinux::config: Configure the system to use SELinux on the system.
• selinux::package: Manages additional packages required to support some of the functions.
• selinux::refpolicy_package: Manages additional packages required to support some of the functions.

Defined types

• selinux::boolean: Manage the state of an SELinux boolean.
• selinux::exec_restorecon: A convenience wrapper around a restorecon exec
• selinux::fcontext: For fcontext equivalences, see selinux::fcontext::equivalence
• selinux::fcontext::equivalence: Manage SELinux fcontext equivalences
• selinux::login: Manage a SELinux login
• selinux::module: Manage a SELinux module on a running system
• selinux::permissive: Set SELinux type to permissive
• selinux::port: Manage a SELinux local network port context setting

Resource types

• selinux_fcontext: Manage SELinux fcontext definitions. You should use selinux::fcontext instead of this directly.
• selinux_fcontext_equivalence: Manage SELinux fcontext equivalence definitions. You should use selinux::fcontext instead of this directly.
• selinux_login: Manage SELinux login definitions. You should use selinux::login instead of this directly.
• selinux_permissive: Manage SELinux permissive types.
• selinux_port: Manage SELinux port definitions. You should use selinux::port instead of this directly.

Classes

selinux

Manage SELinux on RHEL based systems.

Examples

Enable enforcing mode with targeted policy

class { 'selinux':
  mode => 'enforcing',
  type => 'targeted',
}

Parameters

The following parameters are available in the selinux class:

• package_name
• manage_auditd_package
• refpolicy_package_name
• mode
• type
• refpolicy_makefile
• manage_package
• auditd_package_name
• manage_setroubleshoot_packages
• manage_selinux_sandbox_packages
• setroubleshoot_package_names
• selinux_sandbox_package_names
• module_build_root
• default_builder
• boolean
• fcontext
• fcontext_equivalence
• module
• permissive
• port
• exec_restorecon
• login

package_name

Data type: Variant[String[1], Array[String[1]]]

sets the name(s) for the selinux tools package Default value: OS dependent (see data/).

manage_auditd_package

Data type: Boolean

install auditd to log SELinux violations, for OSes that do not have auditd installed by default. Default value: OS dependent (see data/)

refpolicy_package_name

Data type: String

sets the name for the refpolicy development package, required for the refpolicy module builder Default value: OS dependent (see data/)

mode

Data type: Optional[Enum['enforcing', 'permissive', 'disabled']]

sets the operating state for SELinux.

Default value: undef

type

Data type: Optional[Enum['targeted', 'minimum', 'mls']]

sets the selinux type

Default value: undef

refpolicy_makefile

Data type: Stdlib::Absolutepath

the path to the system's SELinux makefile for the refpolicy framework

Default value: '/usr/share/selinux/devel/Makefile'

manage_package

Data type: Boolean

manage the package for selinux tools and refpolicy

Default value: true

auditd_package_name

Data type: String[1]

used when manage_auditd_package is true

Default value: 'auditd'

manage_setroubleshoot_packages

Data type: Boolean

manage the setroubleshoot packages

manage_selinux_sandbox_packages

Data type: Boolean

manage the selinux sandbox packages

setroubleshoot_package_names

Data type: Array[String]

the names of the setroubleshoot packages

Default value: []

selinux_sandbox_package_names

Data type: Array[String]

the names of the selinux sandbox packages

Default value: []

module_build_root

Data type: Stdlib::Absolutepath

directory where modules are built. Defaults to $vardir/puppet-selinux

Default value: "${facts['puppet_vardir']}/puppet-selinux"

default_builder

Data type: Enum['refpolicy', 'simple']

which builder to use by default with selinux::module

Default value: 'simple'

boolean

Data type: Optional[Hash]

Hash of selinux::boolean resource parameters

Default value: undef

fcontext

Data type: Optional[Hash]

Hash of selinux::fcontext resource parameters

Default value: undef

fcontext_equivalence

Data type: Optional[Hash]

Hash of selinux::fcontext::equivalence resource parameters

Default value: undef

module

Data type: Optional[Hash]

Hash of selinux::module resource parameters

Default value: undef

permissive

Data type: Optional[Hash]

Hash of selinux::module resource parameters

Default value: undef

port

Data type: Optional[Hash]

Hash of selinux::port resource parameters

Default value: undef

exec_restorecon

Data type: Optional[Hash]

Hash of selinux::exec_restorecon resource parameters

Default value: undef

login

Data type: Hash[String[1],Hash[String[1],String[1]]]

Hash of selinux::login resource parameters

Default value: {}

Defined types

selinux::boolean

Manage the state of an SELinux boolean.

Examples

Enable named_write_master_zones boolean

selinux::boolean{ 'named_write_master_zones':
   ensure => 'on',
}

Ensure named_write_master_zones boolean is disabled

selinux::boolean{ 'named_write_master_zones':
   ensure => 'off',
}

Parameters

The following parameters are available in the selinux::boolean defined type:

• ensure
• persistent

ensure

Data type: Variant[Boolean, Enum['on', 'off', 'present', 'absent']]

Set to on or off

Default value: 'on'

persistent

Data type: Boolean

Set to false if you don't want it to survive a reboot.

Default value: true

selinux::exec_restorecon

Will execute after all other SELinux changes have been applied, but before Anchor['selinux::end']

Parameters

The following parameters are available in the selinux::exec_restorecon defined type:

• path
• recurse
• force
• refreshonly
• unless
• onlyif

path

Data type: Stdlib::Absolutepath

The path to run restorecon on. Defaults to resource title.

Default value: $title

recurse

Data type: Boolean

Whether restorecon should recurse. Defaults to true

Default value: true

force

Data type: Boolean

Whether restorecon should use force. Defaults to false.

Default value: false

refreshonly

Data type: Boolean

see the Exec resource

Default value: true

unless

Data type: Optional[String]

see the Exec resource

Default value: undef

onlyif

Data type: Optional[String]

see the Exec resource

Default value: undef

selinux::fcontext

For fcontext equivalences, see selinux::fcontext::equivalence

• See also
  • selinux::fcontext::equivalence

Examples

Add a file-context for mysql log files at non standard location

selinux::fcontext{'set-mysql-log-context':
  seltype  => 'mysqld_log_t',
  pathspec => '/u01/log/mysql(/.*)?',
}

Add a file-context only for directory types

selinux::fcontext{'/u/users/[^/]*':
  filetype => 'd',
  seltype  => 'user_home_dir_t' ,
}

Parameters

The following parameters are available in the selinux::fcontext defined type:

• ensure
• seltype
• seluser
• pathspec
• filetype

ensure

Data type: Enum['absent', 'present']

The desired state of the resource. Default: 'present'

Default value: 'present'

seltype

Data type: Optional[String]

String A particular SELinux type, like "mysqld_log_t"

Default value: undef

seluser

Data type: Optional[String]

String A particular SELinux user, like "sysadm_u"

Default value: undef

pathspec

Data type: String

String An semanage fcontext-formatted path specification, like "/var/log/mysql(/.*)?". Defaults to title

Default value: $title

filetype

Data type: String[1]

File type the context applies to (i.e. regular file, directory, block device, all files, etc.)

• Types:
  • a = all files (default value if not restricting filetype)
  • f = regular file
  • d = directory
  • c = character device
  • b = block device
  • s = socket
  • l = symbolic link
  • p = named pipe

Default value: 'a'

selinux::fcontext::equivalence

Manage SELinux fcontext equivalences

Examples

Make /opt/wordpress equivalent to /usr/share/wordpress

selinux::fcontext::equivalence { '/opt/wordpress':
  ensure => 'present',
  target => '/usr/share/wordpress',
}

Parameters

The following parameters are available in the selinux::fcontext::equivalence defined type:

• path
• target
• ensure

path

Data type: String

the path to define and equivalence for. Default: Resource title

Default value: $title

target

Data type: String

the path that this resource will be equivalent to.

ensure

Data type: Enum['present', 'absent']

the desired state of the equivalence. Default: present

Default value: 'present'

selinux::login

This method will manage a selinux login, and will persist it across reboots.

Examples

Add a map for the localuser to staff_u

selinux::login { 'localuser_staff_u':
  ensure   => 'present',
  selinux_login_name  => 'localuser',
  selinux_user => 'staff_u',
}

Parameters

The following parameters are available in the selinux::login defined type:

• ensure
• selinux_login_name
• selinux_user

ensure

Data type: Enum['present', 'absent']

Set to present to add or absent to remove a selinux login.

Default value: 'present'

selinux_login_name

Data type: String[1]

A Linux user or group

selinux_user

Data type: String[1]

The selinux user to map to

selinux::module

This class will either install or uninstall a SELinux module from a running system. This module allows an admin to keep .te files in text form in a repository, while allowing the system to compile and manage SELinux modules.

Concepts incorporated from: http://stuckinadoloop.wordpress.com/2011/06/15/puppet-managed-deployment-of-selinux-modules/

Examples

compile and load the apache module - does not require make or the policy

devel package
selinux::module{ 'apache':
  ensure    => 'present',
  source_te => 'puppet:///modules/selinux/apache.te',
  builder   => 'simple'
}

compile a module the refpolicy way. It will install the policy devel and

dependent packages like make.
selinux::module{ 'mymodule':
  ensure    => 'present',
  source_te => 'puppet:///modules/profile/selinux/mymodule.te',
  source_fc => 'puppet:///modules/profile/selinux/mymodule.fc',
  source_if => 'puppet:///modules/profile/selinux/mymodule.if',
  builder   => 'refpolicy'
}

compile and load a module from inline content

$content = @("END")
  policy_module(zabbix_fix, 0.1)
  require {
    type zabbix_t;
    type unreserved_port_t;
    class tcp_socket name_connect;
  }
  allow zabbix_t unreserved_port_t:tcp_socket name_connect;
  | END
selinux::module{ 'zabbix_fix':
  ensure     => 'present',
  content_te => $content,
  builder    => 'simple'
}

Parameters

The following parameters are available in the selinux::module defined type:

• ensure
• source_pp
• source_te
• source_fc
• source_if
• content_te
• content_fc
• content_if
• builder

ensure

Data type: Enum['absent', 'present']

present or absent

Default value: 'present'

source_pp

Data type: Optional[String]

the source file (either a puppet URI or local file) of a pre-compiled SELinux policy package. Mutually excludsive with using source files.

Default value: undef

source_te

Data type: Optional[String]

the source file (either a puppet URI or local file) of the SELinux .te file

Default value: undef

source_fc

Data type: Optional[String]

the source file (either a puppet URI or local file) of the SELinux .fc file

Default value: undef

source_if

Data type: Optional[String]

the source file (either a puppet URI or local file) of the SELinux .if file

Default value: undef

content_te

Data type: Optional[String]

content of the SELinux .te file

Default value: undef

content_fc

Data type: Optional[String]

content of the SELinux .fc file

Default value: undef

content_if

Data type: Optional[String]

content of the SELinux .if file

Default value: undef

builder

Data type: Optional[Enum['simple', 'refpolicy']]

either 'simple' or 'refpolicy'. The simple builder attempts to use checkmodule to build the module, whereas 'refpolicy' uses the refpolicy framework, but requires 'make'

Default value: undef

selinux::permissive

Set SELinux type to permissive

Examples

Mark oddjob_mkhomedir_t permissive

selinux::permissive { 'oddjob_mkhomedir_t':
  ensure => 'present'
}

Parameters

The following parameters are available in the selinux::permissive defined type:

• ensure
• seltype

ensure

Data type: Enum['present', 'absent']

Set to present to add or absent to remove a permissive mode of a type

Default value: 'present'

seltype

Data type: String

A particular selinux type to make permissive, like "oddjob_mkhomedir_t"

Default value: $title

selinux::port

This method will manage a local network port context setting, and will persist it across reboots.

Examples

Add port-context syslogd_port_t to port 8514/tcp

selinux::port { 'allow-syslog-relp':
  ensure   => 'present',
  seltype  => 'syslogd_port_t',
  protocol => 'tcp',
  port     => 8514,
}

Parameters

The following parameters are available in the selinux::port defined type:

• ensure
• seltype
• protocol
• port
• port_range

ensure

Data type: Enum['present', 'absent']

Set to present to add or absent to remove a port context.

Default value: 'present'

seltype

Data type: String

An SELinux port type

protocol

Data type: Enum['tcp', 'udp']

Either 'tcp', 'udp', 'ipv4' or 'ipv6'

port

Data type: Optional[Integer[1,65535]]

A network port number, like 8514,

Default value: undef

port_range

Data type: Optional[Tuple[Integer[1,65535], 2, 2]]

A port-range tuple, eg. [9090, 9095].

Default value: undef

Resource types

selinux_fcontext

Manage SELinux fcontext definitions. You should use selinux::fcontext instead of this directly.

Properties

The following properties are available in the selinux_fcontext type.

ensure

Valid values: present, absent

The basic property that the resource should be in.

Default value: present

file_type

Valid values: %r{^[abcdflps]$}

The file type to match

Default value: a

selrange

Valid values: %r{\w+}

The SELinux range

selrole

Valid values: %r{\w+}

The SELinux role

seltype

Valid values: %r{\w+}, <<none>>

The SELinux type to apply to the paths

seluser

Valid values: %r{\w+}

The SELinux user name

Parameters

The following parameters are available in the selinux_fcontext type.

• pathspec
• provider
• title

pathspec

Path regular expression

provider

The specific backend to use for this selinux_fcontext resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

title

The namevar. Should be of the format pathspec_filetype

selinux_fcontext_equivalence

Manage SELinux fcontext equivalence definitions. You should use selinux::fcontext instead of this directly.

Properties

The following properties are available in the selinux_fcontext_equivalence type.

ensure

Valid values: present, absent

The basic property that the resource should be in.

Default value: present

target

The target of the equivalence. ie. the path that this resource will be equivalent to

Parameters

The following parameters are available in the selinux_fcontext_equivalence type.

• path
• provider

path

The path to set equivalence for

provider

The specific backend to use for this selinux_fcontext_equivalence resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

selinux_login

Manage SELinux login definitions. You should use selinux::login instead of this directly.

Properties

The following properties are available in the selinux_login type.

ensure

Valid values: present, absent

The basic property that the resource should be in.

Default value: present

selinux_login_name

The name of the linux user or group to map.

selinux_user

The selinux user to map to.

source

Valid values: policy, local

Source of the login configuration - either policy or local

Parameters

The following parameters are available in the selinux_login type.

• provider
• title

provider

The specific backend to use for this selinux_login resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

title

Should be of the form "linuxuser_selinuxuser" or the type may misbehave

selinux_permissive

Manage SELinux permissive types.

Properties

The following properties are available in the selinux_permissive type.

ensure

Valid values: present, absent

The basic property that the resource should be in.

Default value: present

Parameters

The following parameters are available in the selinux_permissive type.

• local
• provider
• seltype

local

Valid values: true, false

A read-only attribue indicating whether the type is locally customized

provider

The specific backend to use for this selinux_permissive resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

seltype

namevar

The SELinux type that should be permissive

selinux_port

Manage SELinux port definitions. You should use selinux::port instead of this directly.

Properties

The following properties are available in the selinux_port type.

ensure

Valid values: present, absent

The basic property that the resource should be in.

Default value: present

high_port

The high end of the port range to manage

low_port

The low end of the port range to manage

protocol

Valid values: tcp, udp

The protocol of the SELinux port definition

seltype

The SELinux type of the SELinux port definition

source

Valid values: policy, local

Source of the port configuration - either policy or local

Parameters

The following parameters are available in the selinux_port type.

• provider
• title

provider

The specific backend to use for this selinux_port resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

title

Should be of the form "protocol_lowport-highport" or the type may misbehave

Changelog

All notable changes to this project will be documented in this file. Each new release typically also includes the latest modulesync defaults. These should not affect the functionality of the module.

v5.0.0 (2024-09-12)

Full Changelog

Breaking changes:

• Drop EoL Fedora 36 #398 (bastelfreak)
• Drop EoL RedHat 7 support #397 (bastelfreak)
• Drop EoL Fedora 30,31,32,33 support #396 (bastelfreak)
• Drop EoL CentOS 7/8 #394 (bastelfreak)
• Drop EoL Debian 10 support #393 (bastelfreak)

Implemented enhancements:

• Add Fedora 36/40 support #395 (bastelfreak)
• use modern stdlib function #391 (vchepkov)
• selinux_build_module_simple.sh: improve quoting #375 (kenyon)

Merged pull requests:

• Ensure examples compile #384 (ekohl)

v4.1.0 (2023-10-31)

Full Changelog

Implemented enhancements:

• Add EL9 support #378 (bastelfreak)
• Add Rocky/AlmaLinux/OracleLinux support #377 (bastelfreak)
• Add Debian 12 support #376 (bastelfreak)

Fixed bugs:

• selinux::login: Miscellaneous fixes #364 (EmRowlands)

Merged pull requests:

• README: refer to metadata.json in the Requirements section #374 (kenyon)
• Remove now redundant variable and method #372 (ekohl)

v4.0.0 (2023-06-29)

Full Changelog

Breaking changes:

• puppetlabs/stdlib: Require 9.x #370 (bastelfreak)
• Drop EoL RHEL 6 support #368 (bastelfreak)
• Drop Puppet 6 support #365 (bastelfreak)
• Drop Puppet 5 support #361 (ekohl)

Implemented enhancements:

• Add puppet 8 support #369 (bastelfreak)
• Add param for selinux::fcontext::equivalence elements #360 (jcpunk)
• Add Debian 11 support by moving the policy packages definition #359 (jcpunk)
• add support for selinux login #356 (bshelton)
• Simplify loading of selinux sandbox tooling #354 (jcpunk)

Fixed bugs:

• Wrap some more commands in "if selinux is enabled" #363 (jcpunk)

v3.4.1 (2021-08-26)

Full Changelog

Merged pull requests:

• Allow stdlib 8.0.0 #348 (smortex)

v3.4.0 (2021-05-29)

Full Changelog

Closed issues:

• Resources that use 'semanage' should have an autorequires on the various packages #345

Merged pull requests:

• Add package autorequires to native types #346 (trevor-vaughan)

v3.3.1 (2021-05-18)

Full Changelog

Closed issues:

• Add support for Fedora 33 #343
• Add support for Puppet 7 #342
• The semanage_ports.py script needs to pick the correct version of python on a system with multiple installed #335

Merged pull requests:

• Deprecate selinux_python_command fact and move handling into provider #336 (trevor-vaughan)

v3.3.0 (2021-04-26)

Full Changelog

Implemented enhancements:

• Install setroubleshoot helpers #328 (jcpunk)
• Support Fedora 31 & 32, drop EOL 28 & 29 #321 (ekohl)

Closed issues:

• Error finding provider when using selinux_port #337
• missing semanage tools on el8 #333
• Manage setroubleshootd/sealert? #327
• Unable to manage ports on RHEL/CentOS 8 #316

Merged pull requests:

• allow puppetlabs/stdlib 7 #340 (kenyon)
• Support Puppet 7 #339 (mattock)
• examples/enable_and_targeted.pp: match type to filename #331 (kenyon)
• Add puppet-lint-param-docs linter / regenerate REFERENCE.md #329 (bastelfreak)
• Resolve puppet-lint #326 (jcpunk)
• modulesync 3.0.0 + code reformatting because of puppet-lint updates #324 (bastelfreak)
• Update module.pp to match current version #308 (ubellavance)

v3.2.0 (2020-04-30)

Full Changelog

Implemented enhancements:

• Amazon Linux v2 should use the new fcontext filetype format #314 (yitsushi)

Closed issues:

• Facter 4 compatibilty #318
• Error: Could not prefetch selinux_fcontext provider 'semanage': uninitialized constant Selinux #311

Merged pull requests:

• Fix several markdown lint issues #319 (dhoppe)
• Update example #315 (ghoneycutt)

v3.1.0 (2019-12-09)

Full Changelog

Implemented enhancements:

• RHEL8 #293
• add partial support for Debian 10, and supporting changes #310 (tequeter)
• Avoid puppet errors when SELinux is disabled #295 (blackknight36)

Fixed bugs:

• "Could not find a suitable provider for selinux_port" on Fedora 28 #254
• Fix selinux_port on RHEL 8/CentOS 8 #298 (oranenj)

Closed issues:

• No autorelabel when enabling SELinux #309
• Just a heads-up - change in RHEL 7.7 #299
• Puppet errors on nodes with SELinux disabled #286
• Missing CentOS 8 support #301

Merged pull requests:

• update example to match current version #307 (ubellavance)
• Regenerate REFERENCE.md #306 (bastelfreak)
• Clean up acceptance spec helper #305 (ekohl)
• Change double quotes to single quotes in example in comments #304 (ubellavance)
• fix reference documentation link #302 (igalic)
• Add EL8 and Fedora 30 to the supported OS list #294 (blackknight36)

v3.0.0 (2019-06-17)

Full Changelog

Breaking changes:

• Python 3 semanage is named python3-libsemanage; Drop Fedora 26/27 support #287 (ehelms)

Fixed bugs:

• Load system policy contexts #290 (ekohl)

Closed issues:

• Fcontext fails on re-run on newer platforms #288

v2.0.0 (2019-05-15)

Full Changelog

Breaking changes:

• modulesync 2.5.1 and drop Puppet 4 #282 (bastelfreak)

Implemented enhancements:

• Allow puppetlabs/stdlib 6.x #284 (alexjfisher)
• Builder improvements and acceptance tests #281 (ekohl)
• Simplify parameter handling #280 (ekohl)

Fixed bugs:

• fix syntax of config_mode fact example #275 (evgeni)

Merged pull requests:

• Update puppet strings and use assert_private #279 (ekohl)

v1.6.1 (2018-10-05)

Full Changelog

Merged pull requests:

• modulesync 2.1.0 & add puppet 6 support #271 (bastelfreak)

v1.6.0 (2018-09-11)

Full Changelog

Implemented enhancements:

• Add support for installing pre-compiled policy packages #253 (oranenj)

Closed issues:

• New release #265

Merged pull requests:

• add initial REFERENCE.md #268 (bastelfreak)

v1.5.3 (2018-08-31)

Full Changelog

Closed issues:

• Puppet change for each selinux module for every Puppet run #261
• Calls to $selinux facts should use the $facts hash #258

Merged pull requests:

• allow puppetlabs/stdlib 5.x #264 (bastelfreak)
• Switch to "facts" hash for SELinux facts #259 (trevor-vaughan)
• Remove docker nodesets #257 (bastelfreak)
• drop EOL OSs; fix puppet version range #256 (bastelfreak)

v1.5.2 (2018-01-20)

Full Changelog

Fixed bugs:

• Update and check runtime SELinux status correcty #249 (weaselshit)

Closed issues:

• Skip exec "change-selinux-status-to-disabled" when current mode is enforcing or permissive #245
• Module uses deprecated hiera_hash() function #238

Merged pull requests:

• Extend enforcing to disabled tests #250 (vinzent)

v1.5.1 (2018-01-04)

Full Changelog

Fixed bugs:

• Fixing change-selinux-status-to-disabled exec #246 (bjvrielink)

Merged pull requests:

• Release 1.5.1 #248 (bastelfreak)

v1.5.0 (2017-12-15)

Full Changelog

Merged pull requests:

• Release 1.5.0 #244 (vinzent)
• Add exec_restorecon to hiera calls #243 (FStelzer)

v1.4.0 (2017-11-19)

Full Changelog

Implemented enhancements:

• Add Fedora 26 and 27 to supported distros #240 (vinzent)

Merged pull requests:

• release 1.4.0 #242 (bastelfreak)
• bump puppet version dependency to >= 4.7.1 \< 6.0.0 #241 (bastelfreak)
• Remove Fedora 24 support statement #239 (vinzent)

v1.3.0 (2017-09-17)

Full Changelog

Implemented enhancements:

• Implement use of force option for restorecon #229 (slconley)

Closed issues:

• Amazon Linux support #230
• Tests fail: Could not parse for environment rp_env: Illegal variable name #225

Merged pull requests:

• release 1.3.0 #236 (bastelfreak)
• Test disabling of SELinux #233 (vinzent)
• Add Amazon Linux support #231 (clinty)
• Re-enable restorecon spec test #228 (vinzent)

v1.2.0 (2017-07-02)

Full Changelog

Implemented enhancements:

• Declare Puppet 5 compatability #226 (vinzent)

Merged pull requests:

• Release 1.2.0 #227 (vinzent)

v1.1.0 (2017-05-11)

Full Changelog

Implemented enhancements:

• Make use of the stdlib puppet_vardir fact instead of a custom one #217 (oranenj)
• Allow specifying module content inline #214 (lightoze)

Fixed bugs:

• config.pp creates tmp as file but selinux_build_module_simple.sh wants to create a dir #215

Merged pull requests:

• Release 1.1.0 #219 (oranenj)
• Fedora 26 uses the same package_name as Fedora 25 #218 (logic)
• Ensure the module build tmp/ directory is actually a directory #216 (oranenj)

v1.0.0 (2017-04-02)

Full Changelog

Breaking changes:

• Remove CentOS 5 support #190
• BREAKING: Redesign selinux::module parameters #178
• BREAKING: Remove restorecond management support #206 (oranenj)
• BREAKING: Remove Amazon Linux support #193 (vinzent)
• BREAKING: Remove support for EL5 and Fedora \< 24 #192 (vinzent)
• BREAKING: Selinux permissive type #183 (oranenj)
• BREAKING: Add selinux_fcontext and selinux_fcontext_equivalence types #177 (oranenj)
• BREAKING: Downgrade enforcing to permissive configuration when SELinux is disabled #175 (oranenj)
• BREAKING: Add a selinux_port type and provider #174 (oranenj)

Implemented enhancements:

• Automatically order resources to not produce runtime failures #147
• selinux::module should not manage files in /usr #146
• Remove dependency on make and selinux-policy-devel in selinux::module #141
• Add a convenience wrapper for restorecon execs #205 (oranenj)
• Replace all validate functions with datatypes #201 (bastelfreak)
• Convert selinux::boolean to puppet types #198 (oranenj)
• Document known problems / limitations #171 (vinzent)

Fixed bugs:

• Can't remove permissive domain #165
• Silently doesn't remove port context #164
• selinux class parameters boolean, fcontext, module, permissive and port are ignored #148
• This module accepts invalid config for port #119
• Actually pass ensure to the wrapped selinux_fcontext resource #210 (oranenj)
• Fix new puppet-lint complaints about ordering arrows #208 (oranenj)
• Don't accept udp6 and tcp6 as protocol name with selinux::port #181 (vinzent)
• Use declared parameters #180 (vinzent)

Closed issues:

• Release 1.0.0 #184
• order of file contexts #121
• selinux::module fails when module contains more than .te file #118
• Looking for Maintainer #106
• Puppet Agent 1.5 (Puppet 4.5 Error) #97
• Unable to modify port via port.pp #93
• When using 'module' to install selinux-module the selinux-mode is set to disabled. #64
• Problem with undef from left operand of 'in' at module.pp:38 #61
• Adding a port gets an error the first time #38

Merged pull requests:

• Prepare 1.0.0 #211 (oranenj)
• Fix resource reference issue when removing fcontexts #209 (oranenj)
• Doc fixes #204 (oranenj)
• Fix spelling for supported type in README #203 (ardrigh)
• Update strings docs #197 (vinzent)
• Remove tests for Fedora 19-23 and CentOS 5 #194 (vinzent)
• Fix puppet strings warnings and minor README.md update #191 (vinzent)
• Rubocop config fixes #182 (vinzent)
• modulesync 0.19.0 #176 (bastelfreak)
• Fix broken link to puppet strings documentation #173 (vinzent)
• Update inline doc to puppet-strings #172 (vinzent)
• Modulesync 0.18.0 #170 (bastelfreak)
• (GH-147) Add ordering of resources #167 (vinzent)

v0.8.0 (2017-01-12)

Full Changelog

Closed issues:

• Acceptance test fails for /tmp/test_selinux_fcontext on Fedora 24 #157
• define selinux::module broken in CentOS 7.3 #142
• Module in the Puppet forge is not up to date #135

Merged pull requests:

• release 0.8.0 #168 (bastelfreak)
• modulesync 0.16.7 #163 (bastelfreak)

v0.7.1 (2016-12-28)

Full Changelog

Closed issues:

• prefix causes repeated module reinstalls #129

Merged pull requests:

• Release 0.7.1 #160 (vinzent)
• Fix usage of non-existent $selinux_enabled fact #159 (vinzent)
• Default to undef for syncversion parameter in selinux::module #158 (vinzent)
• Remove mentions of Ruby requirements in README #156 (juniorsysadmin)

v0.7.0 (2016-12-24)

Full Changelog

Merged pull requests:

• release 0.7.0 #155 (bastelfreak)
• Remove custom fact selinux_custom_policy #154 (vinzent)
• Default module prefix now '' #140 (traylenator)
• Fix type doc #134 (kausar007)

v0.6.0 (2016-12-24)

Full Changelog

Closed issues:

• Ensure a complete relabeling when switching from disabled to permissive or enforcing #149
• selinux::fcontext runs "semanage .. -f a" by default - not supported on RHEL6 #133
• Missing spec test for permissive defined type #130
• No Hiera support #104
• selinux_current_mode core fact no longer exists #74
• Amazon Linux ( CentOS ) is not supported #58

Merged pull requests:

• Modulesync 0.16.6 & Release 0.6.0 #152 (bastelfreak)
• Create /.autorelabel when switching from disabled #151 (vinzent)
• Update to puppet-strings doc in selinux class #150 (vinzent)
• Add acceptance tests #145 (vinzent)
• Set puppet minimum version_requirement to 3.8.7 #144 (juniorsysadmin)
• modulesync 0.16.4 #143 (bastelfreak)
• modulesync 0.16.3 #139 (bastelfreak)
• Fixes #133 Use semange -f 'all files' on RHEL6 #138 (traylenator)
• Use rspec-puppet-facts in all places #137 (traylenator)
• Update README with ruby 1.8 status #136 (alexjfisher)
• add argument variable for selinux::port #132 (jodast)
• Fixes Issue-130 - No rspec for permissive #131 (ryayon)
• Fixes Issue-104 - No Hiera support #128 (ryayon)
• modulesync 0.15.0 #127 (bastelfreak)
• params.pp needs to know about Fedora 25 #126 (logic)
• Rubocop fixes #125 (alexjfisher)
• Add missing badges #124 (dhoppe)
• Update based on voxpupuli/modulesync_config 0.14.1 #123 (dhoppe)
• modulesync 0.13.0 #122 (bbriggs)

v0.5.0 (2016-09-08)

Full Changelog

Merged pull requests:

• Release 0.5.0 #120 (bastelfreak)
• Cleanups and dangling issues #117 (maage)
• Fixing operatingsystem for Amazon Linux #111 (bleiva)

v0.4.1 (2016-09-02)

Full Changelog

Closed issues:

• missing package dependency in ::module (RHEL) #112
• fcontext should check for the existence of $filepath before running restorecon #108
• Should not be running restorecon like this #107
• fcontext detection fails if pattern contains square brackets #105
• Duplicate test? #102
• Tag a new release #96

Merged pull requests:

• modulesync 0.12.5 #116 (bastelfreak)
• Release checks fixes #113 (maage)
• Removes duplicate package test #103 (jfryman)

v0.4.0 (2016-06-02)

Full Changelog

Closed issues:

• custom te file loads every time RE: Only allow refresh in the event that the initial .te file is updated. #95
• selinux::module works only if module name contains local_ by default #90
• selinux-module failing on RHEL 7, Makefile not there #88
• Problems with package duplicate declaration (ensure_packages?) #87
• New release #85
• Missing package selinux-policy-devel #84
• Fedora 23 package name changed #82
• selinux_custom_policy.rb:8: syntax error, unexpected ':', expecting kEND #76
• default SELinux mode and override possibility #65
• Error: CentOS- is not supported #52

Merged pull requests:

• Use ensure_packages to install policycoreutils #100 (jfryman)
• Add recursion support for restorecon. #99 (Heidistein)
• Added support for running restorecon after modifying file contexts #98 (crayfishx)
• Allow specifying selinux module content #94 (lightoze)
• Fix module installation #92 (toddnni)
• Switch to devel package for makefile on RHEL7 and Fedora 21+ #89 (ncsutmf)
• add more lint checks #86 (jlambert121)
• Add support for Factor 1.6 #55 (yannbeulque)

v0.3.1 (2016-03-08)

Full Changelog

Closed issues:

• selinux::fcontext fails in interesting ways when pathname is regex #83
• Error: The parameter 'mode' is declared more than once #80
• tagging new release #75
• Move to selmodule/selboolean for selinux::module/boolean? #70

Merged pull requests:

• The parameter 'mode' is declared more than once #81 (edestecd)
• Add syncversion parameter #78 (mhjacks)
• Fix Issue #76 #77 (Thubo)

v0.3.0 (2015-12-13)

Full Changelog

Closed issues:

• Allow disabling of selinux package management #71
• why is disabled the default mode? #68
• What license is this software provided under? #66

Merged pull requests:

• Pivot to internal types #73 (jyaworski)
• Allow custom package name and management #72 (jyaworski)
• Switch default behavior to not manage selinux #67 (purplexa)
• Whitespace lint fixes #63 (mld)
• Implements SELinux type checking and ensuring. #62 (ElvenSpellmaker)
• added hiera support #49 (dacron)
• Make port exec statement unique for protocol #37 (DLV111)

v0.2.6 (2015-10-20)

Full Changelog

Closed issues:

• Custom Module's reload on every puppet run. #56
• no tag for 0.2.5 #51

Merged pull requests:

• Fix for selinux::module absent case failed notify #59 (ps-jay)
• Fallback to lsbmajdistrelease, if puppet version is \< 3.0 #54 (jkroepke)
• Add Permissive to puppet-selinux module #53 (jewnix)

v0.2.5 (2015-08-05)

Full Changelog

Closed issues:

• port match is not correct enough #39
• "checkloaded" exec always schedules build/install on RHEL7 / CentOS 7 #27

Merged pull requests:

• Fixes workaround, fixes #27 #46 (belminf)
• fix EL variant != 'RedHat' regression #44 (jhoblitt)
• fedora support #43 (jhoblitt)
• puppet 4 support #42 (jhoblitt)
• improve port match #41 (ghost)
• Bug fix for declaring multiple selinux::module types #40 (apatik)
• Use "defined" instead of "getvar" to protect against undefined variables when strict_variables=yes #34 (robinbowes)
• Workaround for RH 7 variants #33 (robrankin)
• Fix to work with strict_variables=true #32 (robinbowes)

v0.2.3 (2015-03-03)

Full Changelog

Merged pull requests:

• add spec tests, update validations, cleanup #31 (jlambert121)
• Better compatibility with CentOS 7 #29 (djjudas21)
• fix change-selinux-status in case of selinux disabled #28 (cristifalcas)

v0.2.2 (2015-01-19)

Full Changelog

Merged pull requests:

• reverting previous lint change #26 (robrankin)
• REPLACE config file route #25 (rmacian)
• Add OS compatibility data for Puppet Forge #24 (djjudas21)
• Lint fixes #23 (djjudas21)
• Switch to a more robust way of changing SELinux status #22 (djjudas21)

v0.2.0 (2015-01-12)

Full Changelog

Closed issues:

• Release to Puppet Forge? #7
• module installation doesn't check current status of modules #6
• /etc/sysconfig/selinux symlink removed #2

Merged pull requests:

• Added Support for defining file types in fcontext defined type #21 (ghost)
• fix dependency name #20 (vchepkov)
• Add missing quotes to exec statement #19 (lattwood)
• puppet 3.7 complaines about 'Error: Failed to apply catalog: Parameter c... #18 (cristifalcas)
• add metadata.json #17 (cristifalcas)
• allow packages to be upgraded #16 (cristifalcas)
• adds RHEL 7 support, fixes missing dependency on package #15 (fuero)
• Linting fixes #14 (steeef)
• support for restorecond and support for restorecond #12 (franzs)
• Add semanage::port functionality #11 (mattwillsher)
• Puppet Lint/Style fixes #10 (mattiasgeniar)
• add option to build with the makefile #9 (tjikkun)
• check if module is actually loaded #8 (tjikkun)
• Updated to support different el versions #5 (thoraxe)
• File context - added method for setting file contexts #4 (thoraxe)
• Fix symlink being removed #3 (lboynton)
• Cleaned up lint errors. #1 (eshamow)

* This Changelog was automatically generated by github_changelog_generator