Created

Embed URL

HTTPS clone URL

SSH clone URL

You can clone with HTTPS or SSH.

Download Gist

selinux::fcontext puppet module that does not take ages to verify.

View gist:4628864
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33
define selinux::fcontext($ensure, $type, $path, $grep) {
# Add or remove a permanent SELinux local file context to the system
# Normally this is done in a specific SELinux module but the define can
# be used for one-offs.
 
case $ensure {
'present': {
exec { "semanage-fcontext-$title":
command => "/usr/sbin/semanage fcontext -a -t $type '$path'",
unless => "/bin/grep -q '^$grep' /etc/selinux/targeted/contexts/files/file_contexts.local",
 
#XXX: The command below is the canonical way to check for active persistant
# file contexts, but this takes ~5 seconds per run instead of the
# simple grep above because semanage fcontext -l takes a long time.
#unless => "/usr/sbin/semanage fcontext -l | /bin/grep -q '^$grep'",
}
}
'absent': {
exec { "semanage-fcontext-$title":
command => "/usr/sbin/semanage fcontext -d -t $type '$path'",
unless => "/bin/grep -q '^$grep' /etc/selinux/targeted/contexts/files/file_contexts.local",
 
#XXX: The command below is the canonical way to check for active persistant
# file contexts, but this takes ~5 seconds per run instead of the
# simple grep above because semanage fcontext -l takes a long time.
#unless => "/usr/sbin/semanage fcontext -l | /bin/grep -q '^$grep'",
}
}
default: {
error("unknown ensure value $ensure")
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Something went wrong with that request. Please try again.