If SELinux is available for the running system, the mode can be managed and booleans can be set.
enforcing:
selinux.mode
samba_create_home_dirs:
selinux.boolean:
- value: True
- persist: True
nginx:
selinux.module:
- enabled: False
Note
Use of these states require that the selinux
execution module is available.
salt.states.selinux.
boolean
(name, value, persist=False)¶Set up an SELinux boolean
salt.states.selinux.
fcontext_policy_absent
(name, filetype='a', sel_type=None, sel_user=None, sel_level=None)¶Makes sure an SELinux file context policy for a given filespec (name), filetype and SELinux context type is absent.
name: filespec of the file or directory. Regex syntax is allowed. filetype: The SELinux filetype specification.
Use one of [a, f, d, c, b, s, l, p]. See also man semanage-fcontext. Defaults to 'a' (all files).
sel_type: The SELinux context type. There are many. sel_user: The SELinux user. sel_level: The SELinux MLS range
salt.states.selinux.
fcontext_policy_applied
(name, recursive=False)¶Checks and makes sure the SELinux policies for a given filespec are applied.
salt.states.selinux.
fcontext_policy_present
(name, sel_type, filetype='a', sel_user=None, sel_level=None)¶Makes sure a SELinux policy for a given filespec (name), filetype and SELinux context type is present.
name: filespec of the file or directory. Regex syntax is allowed. sel_type: SELinux context type. There are many. filetype: The SELinux filetype specification.
Use one of [a, f, d, c, b, s, l, p]. See also man semanage-fcontext. Defaults to 'a' (all files)
sel_user: The SELinux user. sel_level: The SELinux MLS range
salt.states.selinux.
mode
(name)¶Verifies the mode SELinux is running in, can be set to enforcing, permissive, or disabled
- Note: A change to or from disabled mode requires a system reboot.
- You will need to perform this yourself.
salt.states.selinux.
module
(name, module_state='Enabled', version='any', **opts)¶Enable/Disable and optionally force a specific version for an SELinux module
New in version 2016.3.0.
salt.states.selinux.
module_install
(name)¶Installs custom SELinux module from given file
New in version 2016.11.6.
salt.states.selinux.
module_remove
(name)¶Removes SELinux module
New in version 2016.11.6.
Docs for previous releases are available on readthedocs.org.
Latest Salt release: 2017.7.1